Google, geofence warrants, and you

Another day, another example of how the data sharing choices we make can come back to haunt us. The Guardian reports a Florida resident finding his bike ride data requested by law enforcement. This is due to his route taking him close to the scene of a burglary a year earlier. According to the...

CVE-2021-41077

CVE-2021-41077 concerns a Travis CI vulnerability observed during 2021-09-03 to 2021-09-10, where the activation/build process could cause secret data (e.g., signing keys, credentials, API tokens) to be exposed to unauthorized actors that forked public repositories. The issue stemmed from builds ...

Zoom Lied about End-to-End Encryption

The facts arent news, but Zoom will pay $85M -- to the class-action attorneys, and to users -- for lying to users about end-to-end encryption, and for giving user data to Facebook and Google without consent. The proposed settlement would generally give Zoom users $15 or $25 each and was filed...

Intuit to Share Payroll Data from 1.4M Small Businesses With Equifax

Financial services giant Intuit this week informed 1.4 million small businesses using its QuickBooks Online Payroll and Intuit Online Payroll products that their payroll information will be shared with big-three consumer credit bureau Equifax starting later this year unless customers opt out by t...

Insurance and Ransomware

As ransomware becomes more common, Im seeing more discussions about the ethics of paying the ransom. Heres one more contribution to that issue: a research paper that the insurance industry is hurting more than its helping. However, the most pressing challenge currently facing the industry is...

A week in security (May 31 – June 6)

Last week on Malwarebytes Labs, we looked at an interesting trend in facial recognition technology—hint: its a slow fade, the latest ransomware attacks on JBS and Steamship Authority, Cobalt Strike, a Coronavirus phishing campaign, WhatsApp’s decision to not limit app functionalities for...

WhatsApp reverses course, will not limit app functionality

WhatsApp, the end-to-end encrypted messaging service that has lost users, its founders, and a large amount of public goodwill, issued a reversal on its recent privacy policy enforcement measures, clarifying that it will no longer punish users who refuse to share some of their data with the...

The Gig Economy Creates Novel Data-Security Risks

As businesses strive to move faster and faster, many are adopting a “just-in-time” strategy of spinning up human resources on demand – a phenomenon known as the gig economy, familiar to most via Uber, Instacart or DoorDash. But it’s a concept that enterprises are embracing too – inadvertently...

WhatsApp calls and messages will break unless you share data with Facebook

WhatsApp told users last week that there was no need for alarm regarding an upcoming privacy policy deadline, as users who refuse to accept the privacy policy will not have their accounts deleted—they will just have their apps rendered useless, eventually incapable of receiving calls and messages...

Research claims Google Pixel phones share 20 times more data than iPhones

If youre an Android phone user, now might be a good time to invest in a good pair of ear plugs. Fans of iPhones arent known for being shy when it comes to telling Android users that Apple products are superior, and things may be about to get worse, thanks to a new research paper pdf. Researchers ...

containerd 安全漏洞

containerd is a container daemon from the Apache Foundation. The process is responsible for controlling the full cycle of containers on the host according to the RunC OCI specification. A security vulnerability exists in containerd before versions 1.3.10 and 1.4.4 that allows sharing of sensitive...

CVE-2021-27904

The CVE-2021-27904 issue affects MISP 2.4.139, specifically in app/Model/SharingGroupServer.php within the Sharing Groups implementation. The root cause is that the implementation of the "all org" flag can grant view access to unintended actors, exposing sensitive information to unauthorized part...

Yandex Employee Caught Selling Access to Users' Email Inboxes

Russian Dutch-domiciled search engine, ride-hailing and email service provider Yandex on Friday disclosed a data breach that compromised 4,887 email accounts of its users. The company blamed the incident on an unnamed employee who had been providing unauthorized access to the users' mailboxes for...

Fedora 32 : 1:java-11-openjdk (2021-555c9aef71)

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-555c9aef71 advisory. - New in release OpenJDK 11.0.10 2021-01-19: Live versions of these release notes can be found at: https://bitly.com/openjdk11010...

Fedora 33 : 1:java-11-openjdk (2021-5dcdf8b2b1)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-5dcdf8b2b1 advisory. - New in release OpenJDK 11.0.10 2021-01-19: Live versions of these release notes can be found at: https://bitly.com/openjdk11010...

What’s up with WhatsApp’s privacy policy?

WhatsApp has been in the news recently after changes to its privacy policy caused a surge of interest in rival messaging app Signal. Initial reports may have worried a lot of folks, leading to inevitable clarifications and corrections. But what, you may ask, actually happened? Is there a problem?...

WhatsApp Delays Controversial 'Data-Sharing' Privacy Policy Update By 3 Months

WhatsApp said on Friday that it wouldn't enforce its recently announced controversial data sharing policy update until May 15. Originally set to go into effect next month on February 8, the three-month delay comes following "a lot of misinformation" about a revision to its privacy policy that...

WhatsApp Delays Controversial 'Data-Sharing' Privacy Policy Update By 3 Months

WhatsApp said on Friday that it wouldn't enforce its recently announced controversial data sharing policy update until May 15. Originally set to go into effect next month on February 8, the three-month delay comes following "a lot of misinformation" about a revision to its privacy policy that...

Post-Backlash, WhatsApp Spells Out Privacy Policy Updates

WhatsApp is making explicit clarifications around its updated privacy policy, after reports ran amok about the messaging app mandating all-encompassing data-sharing with parent company Facebook. The app’s new privacy policy and terms of service, which will go into effect Feb. 8, says that WhatsAp...

Changes in WhatsApp’s Privacy Policy

If youre a WhatsApp user, pay attention to the changes in the privacy policy that youre being forced to agree with. In 2016, WhatsApp gave users a one-time ability to opt out of having account data turned over to Facebook. Now, an updated privacy policy is changing that. Come next month, users wi...