data privacy Archives

Tag: data privacy

PRISM Watch: US Cyber Command Chief Addresses Black Hat

July 31, 2013 Paul Roberts

I’m here at the Black Hat Briefings in Las Vegas, the U.S.’s most prominent “hacker con.” I’ll be bringing you news and updates from the show and (a bit) from DEFCON for the remainder of the week. As for the Briefings – the long and short of things is that all the buzz right now is about General Keith Alexander’s keynote speech this morning. Of course, keynotes are always a big deal, but its not even 8:00 AM and there’s a bit of a crush in the press room, with TV crews from major media outlets setting up in the Augustus ballroom, where Alexander will speak. Why? This speech is big because its one of the first – if not the first – post-PRISM public address by Gen. Alexander, who is the Commander of U.S. Cyber Command (USCYBERCOM) since the leaks by former NSA contractor Edward Snowden burst into the […]

Podcast: Black Hat Preview With Trustwave’s Nick Percoco

July 26, 2013 Paul Roberts

Next week, the world’s attention will shift to Las Vegas for the annual Black Hat and DEFCON hacking conferences. What will be the big trends this year? We sat down last week with Nicholas Percoco of Trustwave’s Spider Labs to get his thoughts on the show. Nick is a regular at Black Hat and other events – both in the audience and on the stage. He said one of the big themes this year will be hacks on consumer electronics and home automation systems. As we reported, two Trustwave researchers have delved into the security of a wide range of “smart home” technologies, including home automation gateways and even a bluetooth enabled “smart toilet.” Percoco said that manufacturers of these devices need to pay more attention to security, and can’t assume that the people buying their devices are technically sophisticated enough to understand how to safely deploy or manage Internet […]

Six Hours, $4500: The Short Life and Quick Death Of A Facebook Bug

July 22, 2013 Paul Roberts

A security researcher based in Indonesia disclosed yet another Facebook bug this weekend – one that would allow an attacker to obtain the primary e-mail address associated with any Facebook account. Hours after informing the social network about the bug, however, it was closed and the researcher, Roy Castillo, was $4,500 richer. Castillo, a white hat vulnerability researcher based in The Philippines, disclosed the bug in Facebook’s Developer Application Roles Page in a post on his blog on Saturday. When exploited, it allowed an attacker to discover the primary Facebook email address of any account – even those with the email privacy setting on “Only Me,” Castillo wrote. Attackers would need a Facebook Developer account and some basic programming knowledge to take advantage of the vulnerability, in which Facebook mistakenly disclosed the e-mail address associated with a unique Facebook user ID. After discovering the buy on June 25th, Castillo […]

Security Lapse Has Tumblr Asking IPhone, IPad Users To Update -Now!

July 17, 2013 Paul Roberts

Tumblr, the blogging and content sharing web site issued an urgent warning to those using its mobile application for Apple iPhones and iPads to update their Tumblr application – ASAP – after it was apparently found to be transmitting user names and passwords in the clear. In a blog post on Tuesday, Derek Gottfrid, the Vice President of Product at the New York City-based firm, said that the company had issued an update to the iOS version of Tumblr’s mobile application to fix an issue that allowed Tumblr passwords to be sniffed in transit on certain versions of the iOS Tumblr application for iPhone and iPad. Gottfrid did not explain the reason for the sudden update. However, a report by the UK publication The Register claims that the rush update came after Tumblr was made aware that the iOS versions of its application was not using SSL (Secure Socket Layer) […]

Security Must-Do’s For Facebook Graph Search

July 8, 2013 Paul Roberts

Facebook finally pulled the covers off its much-anticipated (or dreaded) Graph Search feature on Monday, after about six months in beta. The new search feature greatly expands the kinds of information Facebook users can access on other users of the social network, making it easy, for example, to cross reference data stored in Facebook profiles. For example, users can easily call up a list of their “friends who live in Boston” and like the show “Arrested Development.” Fun! But, as has been noted, Graph Search is also a social engineer’s dream, because it lays bare lots of information – data – that Facebook users shared, casually, and without a thought of how it might be used in combination with other data they shared. For example, researchers have shown that they can use knowledge of a Facebook user’s “Likes” to “automatically and accurately predict a range of highly sensitive personal attributes including: […]