Internet Security, Abuse, Data Harvesting, Etc.

[LFC]

Google. "Do no harm" is sooooo yesteryear.

Google has settled a privacy lawsuit with a coalition of 40 state attorneys general today. Google agreed to pay $391.5 million for misleading Location History settings the company was running from 2014–2020.

Google's Location History settings have gotten it in trouble with several regulatory bodies. The action began after a 2018 Associated Press article pointed out that the "Location History" check box didn't control all Google location history across your entire account and that many location-tracking features lived under a second check box called "Web & App Activity." Consumers might turn off the "Location History" check box thinking it stopped all Google location tracking, but it was actually only for a single Google Maps feature. Google lost a case in Australia over this setting in 2021 and recently settled a separate lawsuit with Arizona for $85 million. A few other states still have pending lawsuits.

[andydp]

Closest I could find to encryption.

Post-quantum cryptography: What is Emmanuel Macron talking about?

"This tweet may sound technical – it is!" On Thursday, December 1, by announcing on Twitter that the first telegram encrypted using post-quantum technology had been sent, French President Emmanuel Macron was well aware that he would be referencing a topic unfamiliar to the general public. However, the development of post-quantum cryptography is of great importance to the world of cryptography, to confidential communications and, by extension, to the internet.

What is a quantum computer?

A quantum computer is not necessarily more "powerful" than a traditional computer. It is, however, better suited to solving certain problems that an ordinary machine would struggle with. One example is factoring: It is extremely difficult for a classical computer to decompose a number into prime factors, i.e. defining which prime numbers (numbers that can only be divided by themselves) it is the product of. For example, the factorization of 65 is 5 × 13, 5 and 13 being prime numbers.



www.lemonde.fr/en/pixels/article/2022/12/04/post-quantum-cryptography-what-is-emmanuel-macron-talking-about_6006537_13.html?xtor=CS2-33281034-[KW]-[gratuit]-[anglaisaquisition]&utm_source=facebook&utm_medium=paid&utm_campaign=anyword&kwp_0=2219873&kwp_4=6310475&kwp_1=2712578&fbclid=IwAR0LXy2yfFg04nFL-jvmf05qKdBAg9zqyTmA1JY_Dcjy-LtSyd5LW4OMI0c

[LFC]

[heavy sigh] But we expect companies with our data to remain secure.

A hacker has breached an FBI program dedicated to critical infrastructure cybersecurity and is now selling access to its data on the dark web.

Security blogger Brian Krebs reports that InfraGard, an information-sharing program maintained by the bureau, was compromised earlier this month by a cybercriminal who goes by the moniker “USDoD.” After swiping an internal database that contained contact information for “tens of thousands” of InfraGard members, the hacker proceeded to post its contents for sale on the dark web marketplace “Breached,” where anybody can now buy the info for $50,000. The hacker told Krebs that the high price set for the data was a negotiating tactic: “I don’t think someone will pay that price, but I have to [price it] a bit higher to [negotiate] the price that I want,” they said.

InfraGard is an information-sharing network designed to allow high-level professionals both in and out of the government to collaborate on issues of cybersecurity and defense. InfraGard’s membership includes security pros from government agencies and major corporations and, on its website, it describes its mission like this:

InfraGard is a partnership between the Federal Bureau of Investigation (FBI) and members of the private sector for the protection of U.S. Critical Infrastructure. Through seamless collaboration, InfraGard connects owners and operators within critical infrastructure to the FBI, to provide education, information sharing, networking, and workshops on emerging technologies and threats.

In the field of cybersecurity, information-sharing is a popular way for institutions to help protect themselves and each other. Despite InfraGard’s stated mission, however, the FBI apparently missed the emerging threat of a hacker sifting through their network.

[LFC]

Note even $3 per user? Sounds like they got off light.

Meta, the parent company of Facebook, will pay $725 million to settle a class-action lawsuit filed in 2018. The lawsuit came in the wake of Facebook's revelation that it had improperly shared data on 87 million users with Cambridge Analytica, a British political consultancy tied to former President Donald Trump's election campaign.

Cambridge Analytica got its access to Facebook user data via an app developed by a third party. While only around 270,000 Facebook account-holders used the "This is Your Digital Life" app, the app's permissions allowed it access to data on those users' friends. The end result was a dataset covering 87 million users that the developer than passed on to Cambridge Analytica, in contravention of Facebook's terms of service. The vast majority of those in the dataset had not given the consultancy firm permission to access their data.

The unauthorized data sharing came to light in 2018, when reporters from The New York Times and The Observer informed Facebook that Cambridge Analytica still had copies of the data, even though the UK-based firm had promised the social network back in 2015 that the data would be deleted.

The lawsuit against Meta continued on, and other instances of problematic data-sharing practices by Facebook were added to the complaint. Indeed, the lawsuit accused Facebook of giving "numerous third parties access to their Facebook content and information without their consent, [and alleged] that Facebook failed to adequately monitor the third parties’ access to, and use of, that information."

Meta is admitting to no wrongdoing or illegal activity by settling the case. Instead, the company says the $725 million agreement, which must still be approved by a judge, is "in the best interest of our community and shareholders," a Meta spokesperson told Reuters.

Up to 280 million Facebook users are covered by the settlement, which means that $725 million is going to be spread awfully thin after the plaintiffs' attorneys take their 25 percent cut.

[andydp]

I suppose this could fit in either Russia or Ukraine thread, but it does talk operations/cell phone security.

Russia's war in Ukraine shows why troops need to learn to put their phones away, top US Marine general says

The use of new technology on the battlefield has prompted the US military to rethink its operations as it prepares for a future conflict with a technologically advanced adversary, and many of its changes have been validated by the Russia-Ukraine conflict, US Marine Corps Commandant Gen. David Berger said this month.

One of the most important lessons is that your electronics are giving away more information about you than you think, said Berger, who has led an effort to develop capabilities to operate in a more dispersed manner since taking over as the Corps' top officer in July 2019.

(In the middle of the article)

During an exercise in California in 2019, a Marine compromised his unit by taking a selfie that revealed their location. "They were like, 'OK, you guys are dead,'" a Marine general said at the time.

www.msn.com/en-us/news/world/russia-s-war-in-ukraine-shows-why-troops-need-to-learn-to-put-their-phones-away-top-us-marine-general-says/ar-AA15QmIE?ocid=msedgntp&cvid=ef4685a62a204be8a6e7ec2b70f030b9

[LFC]

F***ing Apple got in on the game too.

Your iPhone protects your privacy—from everyone except Apple, apparently.

France’s data protection authority, CNIL, fined Apple €8 million (about $8.5 million) Wednesday for illegally harvesting iPhone owners’ data for targeted ads without proper consent.

It’s an unusual sanction for the iPhone maker, which has faced fewer legal penalties over privacy than its Big Tech competitors. Apple makes privacy a selling point for its devices, plastering “Privacy. That’s iPhone.” across 40-foot billboards across the world. The French fine, though, is the latest addition to a growing body of evidence that Apple may not be the privacy guardian angel it makes itself out to be.

Apple failed to “obtain the consent of French iPhone users (iOS 14.6 version) before depositing and/or writing identifiers used for advertising purposes on their terminals,” the CNIL said in a statement. The CNIL’s fine calls out the search ads in Apple’s App Store, specifically. A French court fined the company over $1 million in December over its commercial practices related to the App Store.

“We are disappointed with this decision given the CNIL has previously recognized that how we serve search ads in the App Store prioritizes user privacy, and we will appeal,” said an Apple spokesperson. “Apple Search Ads goes further than any other digital advertising platform we are aware of by providing users with a clear choice as to whether or not they would like personalized ads.”

[LFC]

Shorter Twitter: "It's not our fault!"

There’s a lot of Twitter news circulating these days, in the long and chaotic wake of Elon Musk’s takeover. But if you are (or ever were) a Twitter user, I promise, this particular story is probably something you probably want to keep tabs on.

The social media platform has claimed that a treasure trove of leaked user data, containing email addresses linked to about 235 million Twitter accounts, did not come from its systems. The compilation of user information ended up on a dark web marketplace, for sale for just about $2, earlier this month, according to multiple reports.

Though email addresses and corresponding Twitter handles might not seem like sensitive info, the leak prompted concerns that anonymous social media accounts could be tied to real-world identities and that the information would make hacking into accounts far easier. Initially, Twitter did not respond to media outlets’ requesting comment or information. But now, about a week later, the company has released a statement.

“Based on information and intel analyzed to investigate the issue, there is no evidence that the data being sold online was obtained by exploiting a vulnerability of Twitter systems,” the company wrote, regarding those 235 million user data points, in a Wednesday night blogpost. “The data is likely a collection of data already publicly available online through different sources,” the post claimed.

In the immediate aftermath of the leak’s detection on January 4, Bleeping Computer reportedly confirmed the validity of a number of the emails. The cybersecurity-focused news outlet also linked those 235 million emails/account pairs to an earlier December leak, containing both phone numbers and emails linked with about 400 million Twitter accounts. Note: Twitter only had around 368 million monthly active users in December 2022, so the leaked data could, in theory, encompass all of these accounts. Allegedly, the smaller January leak was a cleaned up version of the earlier data with fewer duplicates, according to Bleeping Computer.

And, in multiple reports, both of those data dumps were thought to be related to an even earlier security failure, which Twitter publicly acknowledged in August 2022. A fatal flaw in the social platform’s application program interface (API) allowed anyone to get the Twitter ID of a user by searching their phone or email—even if the user in question did not have their phone or email publicly linked with their Twitter handle. The company admitted that the API flaw was related to data being sold by a “bad actor,” and claimed to be notifying affected users.

Though, its Wednesday statement, Twitter has now denied this link. The company claims that, after an internal investigation, the December 400 million user leak “could not be correlated with the previously reported incident, nor with any new incident.” And that the January 200 million account dataset, “could not be correlated with the previously reported incident or any data originating from an exploitation of Twitter systems.” Further, the company claimed that both datasets were the same, with the smaller one simply being cleaned of duplicates—supporting earlier reports.

[LFC]

Oh, FFS!

Online pharmacies that sell abortion pills are sharing sensitive data with Google and other third parties, which may allow law enforcement to prosecute those who use the medications to end their pregnancies, a ProPublica analysis has found.

Using a tool created by the Markup, a nonprofit tech-journalism newsroom, ProPublica ran checks on 11 online pharmacies that sell abortion medication to reveal the web tracking technology they use. Late last year and in early January, ProPublica found web trackers on the sites of at least nine online pharmacies that provide pills by mail: Abortion Ease, BestAbortionPill.com, PrivacyPillRX, PillsOnlineRX, Secure Abortion Pills, AbortionRx, Generic Abortion Pills, Abortion Privacy and Online Abortion Pill Rx.

These third-party trackers, including a Google Analytics tool and advertising technologies, collect a host of details about users and feed them to tech behemoth Google, its parent company, Alphabet, and other third parties, such as the online chat provider LiveChat. Those details include the web addresses the users visited, what they clicked on, the search terms they used to find a website, the previous site they visited, their general location, and information about the devices they used, such as whether they were on a computer or phone. This information helps websites function and helps tech companies personalize ads.

But the nine sites are also sending data to Google that can potentially identify users, ProPublica’s analysis found, including a random number that is unique to a user’s browser, which can then be linked to other collected data.

“Why in the world would you do that as a pharmacy website?” said Serge Egelman, research director of the Usable Security and Privacy Group at the International Computer Science Institute at the University of California, Berkeley. “Ultimately, it’s a pretty dumb thing to do.”

Representatives for the nine sites did not respond to requests for comment. All were recommended on the popular website Plan C, which provides information about how to get abortion pills by mail, including in states where abortion is illegal. Plan C acknowledged that it does not have control over these sites or their privacy practices.

While many people may assume their health information is legally protected, US privacy law does little to constrain the kind or amount of data that companies such as Google and Facebook can collect from individuals. Tech companies are generally not bound by the Health Insurance Portability and Accountability Act, known as HIPAA, which limits when certain health care providers and health plans can share a patient’s medical information. Nor does federal law set many limits on how companies can use this data.

[/div]

[LFC]

People bitch about Apple's restrictions in their Apple Store but Google has a long track record of allowing malware to sneak through. Now it's Google Ads that's serving up malicious sites.

Searching Google for downloads of popular software has always come with risks, but over the past few months, it has been downright dangerous, according to researchers and a pseudorandom collection of queries.

“Threat researchers are used to seeing a moderate flow of malvertising via Google Ads,” volunteers at Spamhaus wrote on Thursday. “However, over the past few days, researchers have witnessed a massive spike affecting numerous famous brands, with multiple malware being utilized. This is not ‘the norm.’”

One of many new threats: MalVirt

The surge is coming from numerous malware families, including AuroraStealer, IcedID, Meta Stealer, RedLine Stealer, Vidar, Formbook, and XLoader. In the past, these families typically relied on phishing and malicious spam that attached Microsoft Word documents with booby-trapped macros. Over the past month, Google Ads has become the go-to place for criminals to spread their malicious wares that are disguised as legitimate downloads by impersonating brands such as Adobe Reader, Gimp, Microsoft Teams, OBS, Slack, Tor, and Thunderbird.

On the same day that Spamhaus published its report, researchers from security firm Sentinel One documented an advanced Google malvertising campaign pushing multiple malicious loaders implemented in .NET. Sentinel One has dubbed these loaders MalVirt. At the moment, the MalVirt loaders are being used to distribute malware most commonly known as XLoader, available for both Windows and macOS. XLoader is a successor to malware also known as Formbook. Threat actors use XLoader to steal contacts data and other sensitive data from infected devices.

[LFC]

There is no line they won't cross if they think it's a) profitable and b) they can get away with it.

Looking for lists of people with depression, anxiety, bipolar disorder, PTSD, or OCD? No problem. There are lots of companies who would love to sell it to you. They can even include names, emails, home addresses, income, ethnicity, and details about people’s children. It’s cheap too, with minimum purchases of just hundreds of dollars. One company offers records on the mental health of 10,000 people starting at $0.20, with a discount if you buy in bulk.

A new study published by Duke University’s Sanford School of Public Policy found nearly a dozen data brokers offering to sell mental health data at rock bottom prices, often with almost no vetting of the person trying to buy the data and minimal restrictions on how the information is used. Many implied they can provide identifiable details like names and contact information.

In the shadows of the internet, an ocean of data brokers scrape up the information that many of us don’t even realize we’re leaving behind and repackage it for advertisers or anyone else who wants it. Many people assume there are laws that protect the most sensitive parts of our lives. That is not the case.

“There are data brokers which advertise and are willing and able to sell data concerning Americans’ highly sensitive mental health information,” author Joanne Kim said in the report. “The research is critical as more depressed and anxious individuals utilize personal devices and software-based health-tracking applications,” which are not covered by HIPAA.

You read that correctly. HIPAA, the Health Insurance Portability and Accountability Act, does not protect your medical privacy. Its health data rules only apply to “covered entities,” which generally means doctors and health care providers, insurance companies, and businesses who work with them directly.

Is it any wonder that women are afraid that Republican Taliban will troll their data to spy on their pregnancies and sex lives? Of course they will! I'm sure they're already doing it!

[goldenvalley]

Feb 13, 2023 17:58:18 GMT LFC said:

There is no line they won't cross if they think it's a) profitable and b) they can get away with it.

Looking for lists of people with depression, anxiety, bipolar disorder, PTSD, or OCD? No problem. There are lots of companies who would love to sell it to you. They can even include names, emails, home addresses, income, ethnicity, and details about people’s children. It’s cheap too, with minimum purchases of just hundreds of dollars. One company offers records on the mental health of 10,000 people starting at $0.20, with a discount if you buy in bulk.

A new study published by Duke University’s Sanford School of Public Policy found nearly a dozen data brokers offering to sell mental health data at rock bottom prices, often with almost no vetting of the person trying to buy the data and minimal restrictions on how the information is used. Many implied they can provide identifiable details like names and contact information.

In the shadows of the internet, an ocean of data brokers scrape up the information that many of us don’t even realize we’re leaving behind and repackage it for advertisers or anyone else who wants it. Many people assume there are laws that protect the most sensitive parts of our lives. That is not the case.

“There are data brokers which advertise and are willing and able to sell data concerning Americans’ highly sensitive mental health information,” author Joanne Kim said in the report. “The research is critical as more depressed and anxious individuals utilize personal devices and software-based health-tracking applications,” which are not covered by HIPAA.

You read that correctly. HIPAA, the Health Insurance Portability and Accountability Act, does not protect your medical privacy. Its health data rules only apply to “covered entities,” which generally means doctors and health care providers, insurance companies, and businesses who work with them directly.

Is it any wonder that women are afraid that Republican Taliban will troll their data to spy on their pregnancies and sex lives? Of course they will! I'm sure they're already doing it!

This is why I won't use any glucose testing apps.  Don't need some future health insurance company raising my premiums because I let my glucose levels go too high 2 days in a row.  

[LFC]

Location data is for sale, and the FBI has been buying.

At a Senate Intelligence Committee hearing yesterday, FBI Director Christopher Wray confirmed for the first time that the agency has in the past purchased the location data of US citizens without obtaining a warrant, Wired reported.

This revelation, which has alarmed privacy advocates, came after Sen. Ron Wyden (D–Ore.) asked Wray directly, “Does the FBI purchase US phone-geolocation information?” Wray’s response tiptoed around the question but provided a rare insight into how the FBI has used location data to surveil Americans without any court oversight.

“To my knowledge, we do not currently purchase commercial database information that includes location data derived from Internet advertising,” Wray said. “I understand that we previously—as in the past—purchased some such information for a specific national security pilot project. But that’s not been active for some time.”

Americans are protected against unreasonable searches under the Fourth Amendment, and the Supreme Court has said that government agencies accessing location data without a warrant can be considered in violation of Fourth Amendment rights. But privacy advocates like the Electronic Frontier Foundation (EFF) have continually found evidence that federal agencies, including the FBI, have relied on a legal loophole to continue purchasing location data that agencies otherwise may not legally be able to access.

During the hearing, Wray said the FBI does not currently purchase location data and has “no plans to change that” right now. Instead, the FBI has a “court-authorized process” for seizing data, which may or may not be easier than obtaining a warrant. Wray didn’t specify how that process works.

[LFC]

Musky Man doesn't seem to think that Twitter's obligation under a legal settlement are binding since he bought the company after the settlement was made. Not that he'd ever say that out loud. (Hell, maybe he would.) Bold of egregious act mine. Using phone numbers entered as part of two-factor authentication is pretty low.

Twitter owner Elon Musk requested a meeting with Federal Trade Commission Chair Lina Khan late last year, but he was rebuffed and told to stop dragging his heels on providing documents and depositions needed for the FTC investigation into Twitter's privacy and data practices, a New York Times report said yesterday.

"In a Jan. 27 letter declining the meeting, Ms. Khan told a Twitter lawyer to focus on complying with investigators' demands for information before she would consider meeting with Mr. Musk," the NYT wrote.

Twitter has to comply with conditions in a May 2022 settlement in which it agreed to pay a $150 million penalty for targeting ads at users with phone numbers and email addresses collected from those users when they enabled two-factor authentication. Last year's settlement was reached after the FTC said Twitter violated the terms of a 2011 settlement that prohibited the company from misrepresenting its privacy and security practices.

Khan's January 27 letter to Twitter reportedly said she was "troubled by Twitter's delays and the obstacles that these delays are creating for the FTC's investigation." Khan's letter criticized Twitter for dragging its heels in providing documents and delaying depositions with witnesses, including Musk, according to the NYT.

"I recommend that Twitter appropriately prioritize its legal obligations to provide the requested information," she wrote to Twitter. "Once Twitter has fully complied with all FTC requests, I will be happy to consider scheduling a meeting with Mr. Musk."

[indy]

Tesla Inc assures its millions of electric car owners that their privacy “is and will always be enormously important to us.” The cameras it builds into vehicles to assist driving, it notes on its website, are “designed from the ground up to protect your privacy.”

But between 2019 and 2022, groups of Tesla employees privately shared via an internal messaging system sometimes highly invasive videos and images recorded by customers’ car cameras, according to interviews by Reuters with nine former employees.

www.reuters.com/technology/tesla-workers-shared-sensitive-images-recorded-by-customer-cars-2023-04-06/

[LFC]

One would have liked to believe that tax preparation companies would be a little more concerned about the importance of securing people’s tax information. One would be wrong. I see that TurboTax is the one preparer that didn’t make the list, but H&R Block did.

Meta and major tax preparation companies inappropriately shared millions of taxpayers’ financial data for years, according to a congressional report released today that was spurred by a Markup article.

Our investigation, which was published in November, revealed how tax filing services including H&R Block, TaxAct, and TaxSlayer were transmitting data to Facebook’s parent company, Meta, through a tool called the Meta Pixel. The data was sent as taxpayers filed their taxes and included personal information like first and last names, income, filing status, and refund amounts. Some data was also sent to Google through its analytics tools, and Google was also a subject of the congressional investigation.

Today’s report from lawmakers was informed by interviews with representatives of Meta, Google, and major tax prep services. It cited and confirmed The Markup’s report and chided the tax companies for being ​​”shockingly careless with their treatment of taxpayer data” and the tech firms for acting “with stunning disregard for taxpayer privacy.”

The report determined that the tax prep companies installed tracking tools from Meta and Google on their services without a full understanding of how tax data might be collected and used, and that the companies were “still not fully aware of the current status of millions of taxpayers’ data.”

Tax data is tightly regulated, with penalties for improper sharing including fines and jail time. The report found the companies involved likely didn’t receive proper consent to share the data and could face criminal penalties.