Manipulative Social Media Practices

The Norwegian Consumer Council just published an excellent report on the deceptive practices tech companies use to trick people into giving up their privacy. From the executive summary: Facebook and Google have privacy intrusive defaults, where users who want the privacy friendly option have to g...

Microsoft Windows 10: Consumer Microsoft account user authentication

When enabled, this policy will prevent all applications and services on the device from new consumer Microsoft account authentication via the Windows OnlineID and WebAccountManager APIs. This policy may not affect applications which have already authenticated until the authentication cache expire...

The CMS Allows Health Plans to Host Their Own Enrollment Applications for Improved Consumer Experience

As part of the ongoing implementation of the Affordable Care Act ACA, the Centers for Medicare and Medicaid Services CMS recently began permitting direct enrollment entities qualified health plan issuers and web-brokers to host their own enrollment applications on their websites instead of proxyi...

Microsoft Windows 10: Turn off Microsoft consumer experiences

This policy setting turns off experiences that help consumers make the most of their devices and Microsoft account. If you enable this policy setting, users will no longer see personalized recommendations from Microsoft and notifications about their Microsoft account. If you disable or do not...

Security Bulletin: Vulnerabilities in Dojo Toolkit affect IBM Worklight and IBM MobileFirst Platform Foundation (CVE-2014-8917)

Summary There are cross-site scripting vulnerabilities in the Dojo Toolkit that is used by IBM Worklight and IBM MobileFirst Platform Foundation. Vulnerability Details CVEID: CVE-2014-8917 DESCRIPTION: IBM Dojo Toolkit is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Worklight (CVE-2014-3509, CVE-2014-5139)

Summary There are multiple vulnerabilities in OpenSSL that is used by the optional FIPS 140-2 data-in-motion feature in IBM Worklight. These issues were disclosed on August 6, 2014 by the OpenSSL Project. Vulnerability Details CVE-ID: CVE-2014-3509 DESCRIPTION: OpenSSL is vulnerable to a denial o...

SAP B2B / B2C CRM Local File Inclusion Vulnerability

SAP enterprise application software solution provider. A local file inclusion vulnerability exists in SAP B2B / B2C CRM. An attacker can exploit the vulnerability to cause malicious data submitted externally to be entered as a variable in the file inclusion process, which could lead to the...

CVE-2018-6236

A Time-of-Check Time-of-Use privilege escalation vulnerability in Trend Micro Maximum Security Consumer 2018 could allow a local attacker to escalate privileges on vulnerable installations due to a flaw within processing of IOCTL 0x222813 by the tmusa driver. An attacker must first obtain the...

Phone Maker BLU Settles with FTC Over Unauthorized User Data Extraction

Android phone-maker BLU Products agreed to a proposed settlement on Tuesday with the Federal Trade Commission, over allegations it allowed the third-party firm Adups Technology to collect detailed consumer data from users without their consent. In an administrative complaint filed earlier this we...

The Internet of Everything and digital privacy: what you need to know

If you don’t already own Internet of Things IoT devices, you likely will soon. IoT-enabled devices are physical gadgets with built-in Internet connectivity that allow data transmission; often this happens in the background with no indication to the user that anything is happening. The IoT is more...

HackerOne CEO Talks Bug Bounty Programs at RSA Conference

SAN FRANCISCO – Marten Mickos, HackerOne CEO, catches up with Threatpost at RSA Conference to discuss hot-button issues around modern bounty programs. Topics range from how to design a program to protect consumer privacy and vulnerability disclosure issues. Mickos also reflects on the growing...

Advancing threat protection through industry-leading research

At Trend Micro we’ve been protecting our customers around the world for 30 years. So what’s the secret to staying at the cutting edge of the industry for all this time? By investing significant resources into forward-looking threat research, we’ve been able to anticipate where the black hats are...

Public Hearing on IoT Risks

The US Consumer Product Safety Commission is holding hearings on IoT risks: The U.S. Consumer Product Safety Commission CPSC, Commission, or we will conduct a public hearing to receive information from all interested parties about potential safety issues and hazards associated with...

Take these steps to stay safe from counterfeit software and fraudulent subscriptions

This post is authored by Matt Lundy, Assistant General Counsel, Microsoft. Software piracy and fraudulent subscriptions are serious, industry-wide problems affecting consumers and organizations around the world. In 2016, 39 percent of all software installed on computers was not properly licensed,...

San Diego Sues Experian Over ID Theft Service

The City of San Diego, Calif. is suing consumer credit bureau Experian, alleging that a data breach first reported by KrebsOnSecurity in 2013 affected more than a quarter-million people in San Diego but that Experian never alerted affected consumers as required under California law. The lawsuit,...

Survey: Americans Spent $1.4B on Credit Freeze Fees in Wake of Equifax Breach

Almost 20 percent of Americans froze their credit file with one or more of the big three credit bureaus in the wake of last year's data breach at Equifax, costing consumers an estimated $1.4 billion, according to a new study. The findings come as lawmakers in Congress are debating legislation tha...

National Consumer Protection Week

March 4–10 is National Consumer Protection Week NCPW, an event to encourage people and businesses to learn more about avoiding scams and understanding consumer rights. During NCPW, the Federal Trade Commission FTC and its partners highlight free resources to help protect consumers. NCCIC/US-CERT...

SQL injection vulnerability in the goods_order.class.php page of the B2B2C multi-store system of UQCMS Cloud Commerce (CNVD-2017-37553)

UQCMS cloud business system is a program using PHP + MYSQL, template using smarty template B2B2C e-commerce software. A SQL injection vulnerability exists in the goodsorder.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System due to the program's failure to adequately filter...

Can Consumers' Online Data Be Protected?

Everything online is hackable. This is true for Equifax's data and the federal Office of Personal Management's data, which was hacked in 2015. If information is on a computer connected to the Internet, it is vulnerable. But just because everything is hackable doesn't mean everything will be hacke...

Turns out Equifax breach was way bigger than initially thought

By Carolina On July 29th Equifax, a consumer credit reporting agency in the United This is a post from HackRead.com Read the original post: Turns out Equifax breach was way bigger than initially thought...