945 matches found
Read private customer data reclaiming carts
Klaviyo read customer quotes for guest carts April 28th I've found a endpoint in a thirth party module Klaviyo Magento 2 which allows to read private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API. Data...
Shining a light on dark patterns with Carey Parker: Lock and Code S02E09
This week on Lock and Code, we speak to cybersecurity advocate and author Carey Parker about "dark patterns," which are subtle tricks online to get you to make choices that might actually harm you. Dark patterns have been around for years, and the tricks theyre based on are even older. Ever bough...
Web Scraping: The Fine Line Between Business Intelligence and Data Privacy Violation. Is it Legal?
Web Scraping is the use of automated software also known as bots to extract content and data from a website. It is also classified by the OWASP as an automated threat OAT-011. Web Scraping differs from Screen Scraping in that it can extract underlying HTML code and data that is stored in database...
Stalkerware Apps Riddled with Security Bugs
Android stalkerware apps – used to surreptitiously track people’s movements and digital activities – turn out to themselves be rife with security holes that put victims in even danger. Stalkerware can track the GPS location of a victim’s device, record conversations, capture images and snoop on...
sudo: possible directory existence test due to race condition in sudoedit
A flaw was found in sudoedit. A race condition vulnerability and improper symbolic link resolution could be used by a local unprivileged user to test for the existence of directories and files not normally accessible to the user. This flaw cannot be used to read the content or write to arbitrary...
New Attacks Slaughter All Spectre Defenses
All defenses against Spectre side-channel attacks can now be considered broken, leaving billions of computers and other devices just as vulnerable today as they were when the hardware flaw was first announced three years ago. A paper published on Friday by a team of computer scientists from the...
Innovative Ways Customers Compute on the Edge
Moving everything closer to the edge is the key to delivering better, faster experiences to people through billions of devices around the world. The idea of edge computing isn't new -- Akamai customers have been caching content at the edge for decades, taking advantage of lower latency and...
Training apps. Have their privacy settings improved in 5 years?
TL;DR Run and bike tracking apps still have a pretty poor approach to password security & default privacy settings From being one of the more secure apps 5 years ago, Strava has now been pushed to the back of this pack as others improved Amazingly, none of these apps support multi factor...
Homeworking vs Homeschooling. The cyber challenge
March 2020 was a significant challenge. We were propelled into lockdown. From happily working in an office I had to switch to working from home. Previously I had always looked at my home as exactly that, a home. A place to relax and spend time as a family. Never did I expect to be spending every...
Afternoon Cyber Tea: Cybersecurity has become a pillar of the business
In a famous two-part episode of “Star Trek: The Next Generation,” Captain Jean-Luc Picard is captured by the Cardassians. During a pivotal scene, a Cardassian interrogator shows Picard four bright lights and demands that he “see” five lights. Picard resists, culminating with him shouting, “There...
Afternoon Cyber Tea: Cybersecurity has become a pillar of the business
In a famous two-part episode of “Star Trek: The Next Generation,” Captain Jean-Luc Picard is captured by the Cardassians. During a pivotal scene, a Cardassian interrogator shows Picard four bright lights and demands that he “see” five lights. Picard resists, culminating with him shouting, “There...
A Post-Data Privacy World and Data-Rights Management
The reality is that today, almost everyone is being tracked and monitored 24/7 with cameras recording our expressions, interactions and speech to determine what we might be thinking, where we are going and who we are meeting. While privacy differs from nation to nation and culture to culture, one...
Google limits which apps can access the list of installed apps on your device
Apps on Android have been able to infer the presence of specific apps, or even collect the full list of installed apps on the device. What's more, an app can also set to be notified when a new app is installed. Apart from all the usual concerns about misuse of such a data grab, the information ca...
Apple, Google Both Track Mobile Telemetry Data, Despite Users Opting Out
Mobile device-tracking by Apple and Google take center stage in a report revealing that, despite both allowing users to opt out of sharing telemetry data – they do anyway. “Both iOS and Google Android transmit telemetry, despite the user explicitly opting out of this,” wrote researcher Douglas...
Netflix/Priam: Temporary Directory Information Disclosure
Impact When File.createTempFile creates a file, the permissions on that file are -rw-r--r--. This means that other users can read the contents of these files after they are written, although they can not modify the contents. This allows for local information disclosure if these files contain...
Rocket.Chat: REST API gets `query` as parameter and executes it
Summary: Any user with 'view-d-room' permission can access any except users.services data from the users collection Description: The "users.list" REST endpoint gets a query parameter from JSON and runs Users.findqueryFromClientSide. This means virtually any authenticated user can access any data...
Apple’s Device Location-Tracking System Could Expose User Identities
Two vulnerabilities in a crowdsourced location-tracking system that helps users find Apple devices even when they’re offline could expose the identity of users, research claim. Offline Finding, a proprietary app introduced by Apple in 2019 for its iOS, macOS and watchOS platforms, enables the...
Microsoft listed as a Representative Vendor in 2020 Gartner Market Guide for Insider Risk Management Solutions
While organizations have long prioritized external cybersecurity risks, many have not paid enough attention to the risks posed by trusted insiders in their organizations. This is a mistake. Insiders often already have access to sensitive data, and the risks, whether malicious or inadvertent, can...
Microsoft listed as a Representative Vendor in 2020 Gartner Market Guide for Insider Risk Management Solutions
While organizations have long prioritized external cybersecurity risks, many have not paid enough attention to the risks posed by trusted insiders in their organizations. This is a mistake. Insiders often already have access to sensitive data, and the risks, whether malicious or inadvertent, can...
