Akamai's 3 Takeaways from the Gartner CIAM Solution Comparison

We have eagerly awaited Gartner's analysis of the growing CIAM industry. According to Gartner, in its August 2019 Solution Comparison for Customer Identity and Access Management Capabilities of 9 Vendors, "CIAM offerings are expanding and are now key business enablers for unifying customer...

CVE-2019-14808

CVE-2019-14808 affects the RENPHO iOS app (version 3.0.0). The client transmits JSON data to the server unencrypted and without an integrity check when users change personal data in their profile or log in, exposing credentials and personal data (e.g., birthday). CVSS v3.1 base score 6.8 (ATT&CK/...

Twitter Uses Phone Numbers, Emails to Sell Ads

Twitter has acknowledged that user phone numbers and email addresses gathered for security purposes, as part of its two-factor authentication policy, may have been used to sell ads. It calls the move an accident. The revelation is being widely criticized for its obvious breach of user privacy,...

The State of Stalkerware in 2019

Introduction and methodology Six months ago, we created a special alert that notifies users about commercial spyware stalkerware products installed on their phones. This report examines the use of stalkerware and the number of users affected by this software in the first eight months of 2019...

Facebook Removed Tens of Thousands of Apps Post-Cambridge Analytica

Facebook said it has suspended tens of thousands of apps as part of its ongoing investigation into how third-party apps on its platform collect, handle and utilize users’ personal data. The results of the investigation, launched in March 2018 in response to Facebook’s infamous Cambridge Analytica...

A Feminist Take on Information Privacy

Maria Farrell has a really interesting framing of information/device privacy: What our smartphones and relationship abusers share is that they both exert power over us in a world shaped to tip the balance in their favour, and they both work really, really hard to obscure this fact and keep us...

CEOs offer their own view of a US data privacy law

Last week, the chief executives of more than 50 mid- and large-sized companies urged Congress to pass a national data privacy law to regulate how companies collect, use, and share Americans’ data. Buried deep within the chief executives’ recommendations for such a law, presented as a policy...

Smart TVs, Subscription Services Leak Data to Facebook, Google

Smart TVs and so-called “over the top” OTT platforms are the latest IoT devices found “spying” on users and leaking sensitive data to companies such as Facebook, Amazon, Google and Netflix, according to two separate studies conducted by university researchers as well as independent research done ...

CVE-2019-11667

CVE-2019-11667 affects Micro Focus Service Manager, with confirmed impact across versions 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, and 9.62. The available descriptions state that an unauthorized actor could access contact information and private data. The connected documents corroborate the affected v...

Facebook, Microsoft Challenge Industry to Detect, Prevent ‘Deepfakes’

Facebook, Microsoft and a number of universities have joined forces to sponsor a contest promoting research and development to combat deepfakes, or videos altered through artificial intelligence AI to mislead viewers. The two tech giants—along with the Partnership on AI and academics from Cornell...

Microsoft Windows NTFS Privileged File Access Enumeration

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFT-WINDOWS-NTFS-PRIVILEGED-FILE-ACCESS-ENUMERATION.txt + ISR: ApparitionSec Vendor www.microsoft.com Product Windows NTFS NTFS is a proprietary journaling file system...

Just An SMS Could Let Remote Attackers Access All Your Emails, Experts Warn

Beware! Billion of Android users can easily be tricked into changing their devices' critical network settings with just an SMS-based phishing attack. Whenever you insert a new SIM in your phone and connects to your cellular network for the very first time, your carrier service automatically...

Just An SMS Could Let Remote Attackers Access All Your Emails, Experts Warn

Beware! Billion of Android users can easily be tricked into changing their devices' critical network settings with just an SMS-based phishing attack. Whenever you insert a new SIM in your phone and connects to your cellular network for the very first time, your carrier service automatically...

Google Targets Data-Abusing Apps with Bug Bounty Launch

Google is looking to squash vulnerabilities on its Google Play app marketplace with a new bug-bounty program aimed at identifying data-abuse issues in Android apps and Chrome extensions. The company on Thursday announced the Developer Data Protection Reward Program, which, depending on the impact...

Venmo's Public Transactions Policy Stirs Privacy Concerns

Your simple $5 Venmo payment to a friend after splitting a pizza could easily expedite various malicious attacks, from stalking to spear-phishing, according to researcher concerns. Many have weighed in on Venmo’s privacy practices, but the latest are Mozilla Foundation and the Electronic Frontier...

Apple Updates Privacy Policies After Siri Audio Recording Backlash

Apple is taking steps to improve the privacy of audio collected by its Siri voice assistant, on the heels of backlash around a program that let contractors listen into Siri conversations. On Wednesday, the phone giant apologized for violating users’ privacy through the program, which was...

Breach at Hy-Vee Supermarket Chain Tied to Sale of 5M+ Stolen Credit, Debit Cards

On Tuesday of this week, one of the more popular underground stores peddling credit and debit card data stolen from hacked merchants announced a blockbuster new sale: More than 5.3 million new accounts belonging to cardholders from 35 U.S. states. Multiple sources now tell KrebsOnSecurity that th...

Google Launches Open-Source Browser Extension for Ad Transparency

Google is launching an experimental, open-source browser extension aimed at increasing transparency around online advertising by displaying information about the ads that are shown to users. The browser extension is an integral part of a new Google initiative announced Thursday to develop a set o...

AT&T, T-Mobile, Sprint, Verizon Blasted For Data Privacy Policies

A U.S. senator has put telecommunication companies – AT&T, T-Mobile, Sprint and Verizon – on notice for their data-collection and retention policies. Last week, U.S. senator Ron Wyden D-Ore. sent an open letter to the CEOs of the four major telecom providers urging them to limit the data they...

Backdoors are a security vulnerability

Last month, US Attorney General William Barr resurrected a government appeal to technology companies: Provide law enforcement with an infallible, “secure” method to access, unscramble, and read encrypted data stored on devices and sent across secure messaging services. Barr asked, in more accurat...