Hacking, Security & Privacy - Page 10

The world has been gripped by the pandemic, changing the very fabric of our society bit-by-bit, and now the Biden administration will lurk around in your smartphone spying on your text messages but it's okay... it's for your own safety, they're the government.

In a new post by Politico, the Biden administration is going into the second season of Utopia by ramping up its attack on anti-vaxxers in an article Polico titled "'Potentially a death sentence': White House goes off on vaccine fearmongers" for maximum fear and SEO.

Anyway, inside of that article are some details on what the Biden administration and DNC have planned for the near future for all Americans: they'll be spying on your text messages. Why? Well, for your safety of course -- as the Biden administration will be working with Big Tech and SMS carriers to "dispel misinformation about vaccines".

The United States was the victim of a malicious ransomware attack on July 4 that has now been called the largest ransomware attack in history.

The attack was carried out on July 4, and since then, a Russia-linked hacking group called REvil has claimed responsibility. REvil has now posted onto its dark web site the choice of purchasing a decryptor software key that would allow for companies to access their data. However, the price of that decryptor software key is $70 million in the form of cryptocurrency.

REvil has affected thousands of users and managed to gain control through firms that manage IT infrastructure for companies remotely. President Biden has previously said to Russia's President, Vladamir Putin, "we will respond" if Russia is found responsible for an attack. Deputy National Security Advisor Anne Neuberger has stated that Biden has "directed the full resources of the government to investigate this incident" and is asking anyone who has been affected by this attack to contact the FBI.

The United States experienced a massive cyberattack last Friday, right at the start of the Independence Day weekend.

President Joe Biden has said that at the moment, the US isn't sure "who it is", and that the "initial thinking was it was not the Russian government." However, Biden also said that he has spoken to Russian President Vladimir Putin and said that if Russia is found to be guilty of the attack, the US will respond. "But if it is Russia, I told Putin we will respond", said Biden, in reference to their meeting last month in Geneva, Switzerland.

The cyberattack affected at least 200 companies across the United States, with the cyber-security firm, Huntress Labs describing the attack as "colossal". Earlier reports indicate that Huntress Labs believe the Russia-linked REvill ransomware gang was responsible for the attack. The first attack happened at the Kaseya, a Florida-based IT company. If you are interested in reading any more information about this story, check out this link here.

TikTik has just changed its US privacy policy that includes a new section that says the social video sharing app "may collect biometric identifiers and biometric information" from users' content. Nice.

The biometric identifiers and information will include things like "faceprints and voiceprints", with details on the biometric data collection introduced in a new section TikTok has dubbed "Image and Audio Information" under the heading of "Information we collect automatically" in its newly-revised US privacy policy.

TikTok was already pretty liberal with the amount of data it scrapes from users on the daily, but now it is in overdrive with the new section explaining that it will be collecting information about the images and audio that is in users' actual content.

On June 8, Amazon will be debuting what it has called "Amazon Sidewalk," which will enable all compatible devices into a brand new service.

Amazon Echo speakers and Ring cameras will automatically be hooked up to the Sidewalk service automatically, allowing strangers to use your Wi-Fi connection. Amazon has said that Sidewalk is being rolled out as a way to increase home security. Here's how it works. If you choose to keep Sidewalk enabled, your compatible Amazon devices will connect to other Sidewalk compatible devices within a mile range.

The connection with surrounding devices will allow compatible devices to use an active internet connection even if your home internet connection is currently offline. Essentially, if you have Sidewalk enabled and your internet goes down, your Ring device will jump from using your home connection to a surrounding connection so the device can remain active, thus keeping the security of your home enabled. If you don't want Sidewalk enabled, you can choose to opt out of it by simply going to Account Settings and looking for Amazon Sidewalk and toggle it off.

The United States is currently under siege when it comes to cyberattacks, forcing the White House to respond to recent events.

Major infrastructure such as pipelines, water-treatment plants, hospital I.T. systems, and more have all experienced cyberattacks. Cyberattacker cut off a pipeline to the Eastern Seaboard for days and also attempted to poison a Florida water-treatment plant. According to Fox News, other major infrastructure is being targeted as well, such as transportation hubs, energy facilities, and utility companies.

From the attacks that have already occurred, it's reasonable to suggest they can be seen as acts of war, especially when you consider how many millions of lives would be affected if, for example, drinking water was poisoned for an entire city. Not to mention, holding hostage hospital I.T. systems is certainly not what an ally does. President Biden signed an executive order on Wednesday that will add additional strength to the seemingly buckling U.S. cyber defense systems, as well as boost the Cybersecurity and Infrastructure Security Agency (CISA).

Another day, another huge Facebook data leak with the personal data of 533 million users has leaked online and is available for free.

Business Insider reports that it has verified the leaks, explaining: "The exposed data includes personal information of over 533 million Facebook users from 106 countries, including over 32 million records on users in the US, 11 million on users in the UK, and 6 million on users in India. It includes their phone numbers, Facebook IDs, full names, locations, birthdates, BIOS, and - in some cases - email addresses".

Facebook explains that it had fixed a vulnerability in 2019 and that the data scraped was from back then, and not current data. But the information on the users is the same with the biggest point here being the phone numbers, as many more services now just require a phone number for registration and as the creator of Have I Been Pwned database, Troy Hunt, explains:

It seems foreign hackers have gained access to the networks of both the US Department of Energy and National Nuclear Security Administration.

There are new reports from both Bloomberg and Politico that say federal investigators say was part of a "Russian cyber attack that struck a number of federal government agencies. Microsoft Corp. was also breached, and its products were used to further attacks on others".

Shaylyn Hynes, a Department of Energy spokeswoman, said in a statement: "At this point, the investigation has found that the malware has been isolated to business networks only".

The Trump administration is bringing down the ban hammer on both TikTok and WeChat in the United States, starting this Sunday.

WeChat will be blocked from US app stores starting on Sunday, with the same bans hitting TikTok on November 12. Commerce Secretary Wilbur Russ explained in a statement: "Today's actions prove once again that President Trump will do everything in his power to guarantee our national security and protect Americans from the threats of the Chinese Communist Party".

President Trump signed an executive order on August 6, giving TikTok 45 days to GTFO of the United States -- well, Sunday is 45 days from August 6.

If you didn't know, Joe Biden has an official 2020 Presidential campaign app called 'Vote Joe', and unfortunately, it was discovered that the app had a critical bug that exposed user information.

According to a new report from The App Analyst, the app, which is designed to send users pro-Biden texts, nearby events, campaign updates, etc, was found to have a critical bug in it that exposed sensitive user information. The sensitive user information that was exposed was home addresses, birthdays, phone numbers, and prior voting history.

The App Analyst explains that the bug in the app made it very easy for anyone to access this information and that anyone who signed up to the app with a fake email address was granted access to a TargetSmart database. Through this database, users would be able to access more than 190 million voter records. Last week the Biden campaign notified of this bug and has since worked with its third-part app developer to resolve the issue.

Apple is warning customers to not cover their camera over concerns of their privacy, as it may damage the MacBook notebook they're using.

The company is telling people not to cover their cameras up as it will also create issues with the automatic brightness and True Tone technologies, with the company explaining: "If you close your Mac notebook with a camera cover installed, you might damage your display because the clearance between the display and keyboard is designed to very tight tolerances".

Apple continues: "Covering the built-in camera might also interfere with the ambient light sensor and prevent features like automatic brightness and True Tone from working. As an alternative to a camera cover, use the camera indicator light to determine if your camera is active, and decide which apps can use your camera in System Preferences".

Remember the MGM Hotel data breach in 2019? It was meant to be 10.6 million people, but it exposed a huge 142 million hotel guests.

Back in February 2020, a data breach affected 10.6 million hotel customers that stayed at MGM Resorts. At the time, the company said that the hackers bnreached their dfatabase in 2019, and that they'd notified people. Well, MGM might have notified a significant lower number of people affected because the numbers are baffling.

ZDNet is reporting that it wasn't 10.6 million customers that had their data breached, but rather over 10x that amount with 142 million customers details now hanging out on the dark web with a hacker selling them for $2939.

As Trump begins to get back out and rally his supporters for this years election, cybersecurity analysts have noticed some security vulnerabilities with the President's official campaign app.

If you are wondering what this official campaign app is, it's an app developed specifically for President Trump's reelection campaign. If you head over to this website, and enter your phone number, you will receive a one time SMS to download the free app that will give you exclusive content and campaign updates. It's available on both the App Store and Google Play.

The issue with this app is that cybersecurity analysts, Noam Rotem and Ran Locar, have found some critical security vulnerabilities in the app. According to WebsitePlanet, where the analysts posted their findings, the app's code "revealed keys and secrets, similar to usernames and passwords, that gave access to different parts of the app, such as its Twitter API." The cybersecurity researchers also said, "While the exposed keys allowed access to many parts of the app, we concluded in our investigation that user accounts remained inaccessible through this vulnerability."

Anonymous seems to have awoken once again, and this time the hacktivist group is targeting the main source of controversy, the Minneapolis Police Department.

In a video released onto the official Anonymous Twitter account, we see a member of the group wearing the iconic Guy Fawkes mask, talking directly into the camera. The member explains that officers who believe they can kill people and commit other crimes need to be held accountable "just like the rest of us", otherwise they will think they have a license to do whatever they want.

The video goes onto say that the people have "had enough of this corruption and violence from an organization that promises to keep them safe". Anonymous then begins to target the Minneapolis Police Department by saying that the officers behind the George Floyd killing need to face charges, and officer Chauvin should face murder charges. "Unfortunately, we do not trust your corrupted organization to carry out justice, so we will be exposing your many crimes to the world".

It seems like something out of a Mission: Impossible movie, but a new hack is able to steal data from your PC through your power supply -- yeah, I just said your power supply. Check it out:

The new hack is capable of taking data from a completely air-gapped system, which is completely disconnected from the internet. This means it has no connection to the internet, Wi-Fi, Bluetooth, or any other connection to the internet. Air-gapped systems are considered virtually impossible to siphon data from, but someone is now doing through power supplies.

Dr. Mordechai Guri from the Ben Girion University in Israel is behind the revelations, with a new hack he calls POWER-SUPPLaY. How does it work? Get this: malware is installed onto the target PC, which then reads out the system data and makes some changes to the CPU workload.

The Australian government is tightening things Down Under to control coronavirus spread in the country, with lockdowns and borders heavily enforced the Australian government and authorities.

Just like the current app deployment in Singapore, the Australian government is now forging through with plans to release an app to track coronavirus victims, and just exactly where they go. Australia is wanting to lift COVID-19 restrictions that have seen millions of people stop their lives -- work, running businesses, school and everything in between -- and this app, could be the solution.

The Australian government first said that it would be making the coronavirus tracking app mandatory -- but Australian government quickly hopped back a step or two. Australians saw the move as draconian, but Australian Prime Minister Scott Morrison tweeted out that it wouldn't be mandatory.

With all of the current shelter-in-place, quarantines, and global lockdowns -- services like Zoom have seen a gigantic surge in popularity and use by companies and people around the world.

Well, did you know that over 500,000 Zoom accounts are being sold on the dark web and hacker forums for as low as 1c each, and in some cases, they're even free? Yeah, so new reports show that Zoom login details are happening through credential stuffing attacks, where hackers will login to Zoom accounts using leaked data from previous breaches.

If the login in successful, that Zoom account login goes into a list and is then sold to other hackers. Some of the Zoom accounts are offered up on a platter on the cheap, or for free -- where other hackers will use them for "zoom-bombing pranks" and "other malicious activities", reports BleepingComputer.

Zoom is in serious doo-doo right now, with the videop conferencing provider now admitting that users' calls from around the world were routed through China.

Zoom CEO Eric Yuan admitted that his company "mistakenly" routed calls through China, he explained: "In our urgency to come to the aid of people around the world during this unprecedented pandemic, we added server capacity and deployed it quickly - starting in China, where the outbreak began".

Yuan continued: "In that process, we failed to fully implement our usual geo-fencing best practices. As a result, it is possible certain meetings were allowed to connect to systems in China, where they should not have been able to connect".

One of the biggest cybercrime bot networks has been attacked by Microsoft and its partners and is now facing massive disruption in its day-to-day activities.

According to Microsoft's blog post, just yesterday, Microsoft and its partners from 35 countries conducted a coordinated legal and technical attack on one of the world's most prolific botnets called Necurs. Necurs is reported to have infected over 9 million computers around the world, and the disruption that Microsoft and its partners have been coordinated has taken eight years of researching, tracking, and planning.

Microsoft explains that a botnet is a network of computers that are designed to infect computer users around the globe with malicious software or malware. Once those computers are infected, the cybercriminals control those computers remotely from a secure location and use them to commit crimes. Necurs botnet is one of the largest networks in the spam email threat ecosystem, and Microsoft says that "we observed that one Necurs-infected computer sent a total of 3.8 million spam emails to over 40.6 million potential victims."

Avast Antivirus is one of the largest free Antivirus software's you can download on the internet, and now an investigation is being conducted into the company for reportedly selling user data.

According to Dark Reading, the Czech Office for Personal Data Protection is now investigating the actions of the Prague-based antivirus software company, Avast. The investigation is to find out whether or not Avast has been selling personal information from its user base to companies such as Google, Microsoft, and Home Depot.

The data that is suspected to have been sold off to these companies is browser history of users, online map searches, YouTube viewing habits, and more. Back in January, Motherboard and PCMag found evidence of Avast collecting data and selling it through its subsidiary company called "Jumpshot". Since this was discovered, Avast as closed down its Jumpshot division.