Hacking, Security & Privacy - Page 11

The FBI has reported the highest amount of scammed losses in 2019 since it's Internet Crime Complaint Center was created.

According to the FBI.gov website, the internet safety arm of the FBI called 'Internet Crime Complaint Center' (IC3) issued out their 2019 report, which stated some worrying figures. The report says that during 2019 the IC3 received 467,361 complaints, which equated to an average of nearly 1,300 a day. It also recorded the highest amount of monetary losses since the center was established back in May, 2000.

The FBI says that more than $3.5 billion losses were recorded from individuals and businesses who fell victim to online scams. Scams such as phishing, non-payment/non-delivery scams, and extortion were the most common form of received complains. The complaints which ended up being the most financially costly were business email compromise (BEC), romance or confidence fraud, and mimicking the account of a person or business vendor.

What if I told you that the United States intelligence agencies secretly owned a device manufacturing company that provided both foreign country officials, and U.S. officials with devices they could listen to?

According to a new report by the Washington Post and ZDF, the United States intelligence agencies secretly owned and ran a company that supplied government spy officials with devices that allowed them to listen in to all communications. The report by WAPO and ZDF detail how the CIA, NSA, and Western German intelligence ran in secret one of the world's largest encrypted communications supplier called Crypto AG.

Foreign governments were reportedly paying the U.S. and West Germany "good money" for supplying them with secrets from these devices that were recording all communications between spy officials. Even U.S. officials weren't safe from the phony devices, with the report saying that higher-up officials insisted that the rigged devices be sent to all persons, ally or not. Crypto AG didn't just make rigged devices either. The report states that two versions were made -- one for friendly governments (select countries/persons) and the other rigged systems that would be provided to the rest of the world. For more information about this discovery, check out this link here.

Data leaks are never good, and as the internet is adopted by more and more people every day, hackers are continuously finding holes in business networks and leaking sensitive data online.

In this instance, we are talking about JailCore, which is a correctional facility management and compliance cloud-based application. vpnMentor, who is a cybersecurity research team, found that 36,077 files were leaked online from an Amazon server linked back to JailCore. Now, these files were nothing to roll your eyes at, as they contain sensitive information for inmates in detention centers located in the following states; Flordia, Kentucky, Missouri, Tennessee, and West Virginia.

The data leak is a large threat to the inmates whose sensitive information was exposed, as criminals who are outside of prison and have nefarious motives can easily steal a person/s identity. The leak contained data in the following categories; prescription records, dosage amounts, correctional officer names, inmates' full names, headcounts, inmate ID, dates of birth, cell locations, officer audit logs, mugshots, inmate activity records, and much more. If you are interested in checking out what else was leaked online, visit this link here.

A California man is facing some serious charges as he has pleaded guilty to hacking Nintendo servers while also possessing child pornography.

21-year-old Palmdale, California man, Ryan Hernandez, has pleaded guilty to charges laid against him for both hacking Nintendo systems and stealing company secrets as well as downloading and possessing child pornography. According to the US Department of Justice website, Hernandez used a "phishing technique" to steal the credentials of a Nintendo employee, which gained him access to Nintendo's servers, where he downloaded confidential files.

The files contained explicit information about Nintendo's coming console, upcoming games, developer tools, and more. The FBI contacted Hernandez back in October 2017, and gave him a warning, Hernandez promised to stop any further hacking attempts and acknowledged that he understood the consequences if he continued to do so. Hernandez continued his malicious online activity throughout 2018 and 2019, continuing to hack Nintendo servers and bragging about his wrongdoings on Twitter and Discord.

A cybercriminal hacking group has given everyone a friendly reminder that anything online can be hacked and exploited.

The reminder has come via from hacking group 'OurMine', who hijacked various social media accounts of fifteen different US National Football League (NFL) teams. OurMine posted onto the social media accounts of the teams a similar message; it reads as follows; "Hi, we're OurMine. We are here for 2 things: 1) Announce that we are back 2) Show people everything is hackable".

The post continued and said, "to improve your accounts security contact us: contact@ourmine. org". The teams that were affected by the hijacking were NFL's own Twitter account and various social medias (Instagram/Facebook/Twitter). The following teams; Kansas City Chiefs, Green Bay Packers, Dallas Cowboys, Denver Broncos, Indianapolis Colts, Houston Texans, New York Giants, Philadelphia Eagles, Tampa Bay Buccaneers, Los Angeles Chargers, San Francisco 49ers, Cleveland Browns, and Arizona Cardinals.

Google has announced via its security blog that throughout 2019 the company paid out a new record to researchers for finding exploits in their products.

If you didn't know, Google rewards people who have found exploits in Google's security system. This reward program is called 'Vulnerability Reward Programs'. Every year Google announces a new report on how much money they have paid out to users, and throughout 2019 Google has set a new record.

In 2018, Google paid out $3.4 million in total to users who were able to assist Google in increasing their security defenses. In 2019, the company had a record-breaking year by doubling what it paid out in 2018, reaching the total payout sum of $6.5 million. If you are interested in checking out Google's full report, head on over to the website here.

Researchers have found that a porn cam affiliate network has left 20GB of extremely sensitive data of models exposed online.

The research group is vpnMentor and found that a porn cam affiliate website PussyCash left 20GB of extremely sensitive information of models on the website exposed in an Amazon S3 bucket. The researchers found a mix of different sensitive data; images, videos, passports information, ID photos, driver licenses, and more. Some of the data was traced back to be about 20 years old, while some other forms of data were as recent as a couple of weeks old.

Around 4,000 models across the world were subjected to sensitive data exposure, and it could have serious implications on the models if nefarious people acquire the data and use it for blackmail purposes. PussyCash never responded to the notifications of the exposure by vpnMentor, but another brand under the company "ImLive" said that they would sort out the problem.

If you are after some fast cash and have competent hacking skills, then you might be in luck because the annual Pwn2Own hacking competition is offering up ridiculous prizes.

Pwn2Own is a hacking competition that is scheduled to begin March this year in Vancouver. At this competition hacking, experts and security researchers can put their skills to the test and break into some of the secure digital infrastructures ever made -- and they are handsomely rewarded for it. The press release says that Tesla vehicles come with three distinct layers of security, and for each of these layers being compromised, a reward will be given to the hacker.

Looking at the highest prize, achievable - Tier 1. Tier 1 represents a complete vehicle compromise, and to win this tier, the hacker will have to "pivot through multiple systems in the car, meaning they will need a complex exploit chain to get arbitrary code execution on three different sub-systems in the vehicle." If a participant manages to do this, they will walk away with a Tesla Model 3 and $500,000 in cash. Additionally, more money can be acquired if the hacker manages to hack into the peripherals of the Model 3. For more information, check out this link here.

The United States has a government initiative targeted at low-income Americans, and the premise of this initiative is to make it easier for low-income Americans to acquire a smartphone.

While that sounds like an amazing idea, and it is, what if those smartphones were found out to have pre-installed Chinese malware? Unfortunately, that seems to be the case as in October 2019, Malwarebytes started to receive complaints in its support system from users who were purchasing the most inexpensive smartphone that Assurance Wireless sells. Assurance Wireless, which is a federal Lifeline Assistance program under Virgin Mobile, is supported by the federal Universal Service Fund.

The most inexpensive smartphone they were selling was the Unimax (UMX) U686CL, and this was the phone that researchers picked up to test consumers' claims. It was discovered that the U686CL harbored malicious apps, such as an app called Wireless Update. The origin of this app can be traced back to Adups malware, which was created by a Chinese company that was caught gathering user data, creating backdoors users' phones, and auto-installing other malware.

Microsoft has announced a brand new online weapon that is designed to protect children from being groomed online by predators.

The new weapon is called "Project Artemis" and according to Mircosoft's blog post, is a new technique that can detect and report people who are suspected of child grooming. So how does it work? Project Artemis is a text-based review system that reviews conversations between people online and determines through a rating system whether or not its likely a party is grooming a child.

If a party is deemed likely to be grooming Artemis will then flag the conversation and notify a human moderator to come and check it for further evaluation. Project Artemis has been in development since November 2018, Microsoft hasn't been alone in the development either as The Meet Group, Roblox, Kik, Thorn and others have also given their assistance. Microsoft says in their post, "Project Artemis" is a significant step forward, but it is by no means a panacea". The fight for child safety online continues.

CES 2020 - In this day and age, people are equipping their homes with cameras to help deter intruders. Most, if not all, of these cameras, require some form of wiring, but not Arlo's new camera.

Arlo has announced it's Arlo Pro 3 Floodlight Camera, a camera that is called the first truly wireless solution of its kind. The camera can be placed wherever it needs to go and has no connections, all users have to do is maintain the battery, and that's it.

The camera also has the capability of being able to record 2K + HDR support. It also has color night vision, an ambient light sensor that adjusts the brightness of the floodlight depending on surrounding light, and two-way audio if you really want to scare an intruder with your voice. The Arlo Pro 3 Floodlight Camera comes in at $250.

A security researcher has reported that Facebook had more than 267 million users' sensitive information exposed online.

According to a report from Comparitech and a security researcher Bob Diachenko, more than 267 million Facebook users had their IDs, phone numbers and names exposed to the public online. This was discovered in a database that could be accessed without any means of a password or authentication, essentially being available to the public who would know how to access it.

Researchers believe this sensitive information was gathered as a part of an illegal scraping operation. According to Dianchenko, this data was exposed for nearly two weeks and was posted as a downloadable file in hacker forum. A Facebook spokesperson spoke to Engadget and said, "We are looking into this issue, but believe this is likely information obtained before changes we made in the past few years to better protect people's information".

Amazon has just done something very, very naughty that might get them scrubbed off Santa's nice list -- the everything giant has just leaked out every single home address of its Ring surveillance camera customers.

In a new investigation by Gizmodo, it revealed that thousands of Amazon Ring camera customers have had their home addresses leaked. The exact location of their house has been displayed, with Gizmodo (and myself, and I'm sure anyone that reads this story) completely blown away. Gizmodo says its discovery casts "new doubt on the effectiveness of the company's privacy safeguards".

Gizmodo continued, adding that its discovery "further offers one of the most "striking" and "disturbing" glimpses yet, privacy experts said, of Amazon's privately run, omni-surveillance shroud that's enveloping U.S. cities".

While China is usually labeled as a security state, it's been discovered that the USA has more CCTV camera's per person than anywhere in the world.

A new report was published by PreciseSecurity details, the number of closed-circuit TV (CCTV) cameras installed by each country. Each of these cameras has a purpose of monitoring what its viewing for security reasons, and if you expected China to have the most cameras you would of suspected right. PreciseSecurity says that China leads the world in CCTV cameras with 200 million installed.

The USA follows behind China with 50 million, then it drops down to Germany with 5.2, and then the United Kingdom with 5 million. What is most interesting, though, since China has such an overwhelming population, the USA actually holds 1st place for the 'highest number of CCTV cameras per person in the world' with 15.28 cameras per 100 people. China follows closely behind the US with 14.36 cameras per 100 people, and then the UK comes in with just 7.5 CCTV cameras per 100 people. For more information check out the report here.

The Black Friday sales just finished and just like every year a lot of people decided to pick up a new TV while they were heavily discounted. Now, the FBI has warned the public that the smart TV they just bought could possibly be hacked.

Since Black Friday has just finished, many participants in the sales would have grabbed a new snazzy TV for their family living room. While that is certainly a most-welcomed upgrade, it does come with a considerable potential downside. Since recently purchased TVs are smart TVs, they are designed to be connected to the internet for a means of accessing streaming platforms such as Netflix, Amazon Prime etc. Since they connected to the internet, that means they can be hacked.

A lot of the smart TVs being sold also have microphone and camera support, so if a hacker were somehow able to access your TV, they would be able to activate the TV's microphone and camera to listen in and watch you. FBI's Portland field office has warned of this very thing, saying that "Beyond the risk that your TV manufacturer and app developers may be listening and watching you, that television can also be a gateway for hackers to come into your home."

In another 'Only in Japan' post -- you can stay overnight in the Asahi Ryokan hotel for just $1 per night, but there's a big catch -- you'll need to livestream your stay 24/7.

Asahi Ryokan owner Tetsuya Inoue made the changes not long after taking on the business after his grandmother founded it, and tried to improve it for the new economy of 2019 and beyond. Asahi Ryokan is now offering guests rooms for just $1 per night if they agree to allowing their stay overnight (or longer) to be livestreamed.

There are rules and at least some privacy, with Asahi Ryokan not placing cameras in the bathroom, guests can turn the lights in the room on or off, and most importantly the livestream is video-only, so there's no audio to listen to that gives a thin layer of privacy. Inoue began running the hotel starting in 2018, explaining: "This is a very old ryokan and I was looking into a new business model. Our hotel is on the cheaper side, so we need some added value, something special that everyone will talk about".

In what has become one of the largest data leaks from a single source in history, the personal data of over 1.2 billion people has been exposed -- including names, email addresses, phone numbers, LinkedIn, Facebook, Twitter and more.

The leak was discovered by Bob Diachenko and Vinny Troia on October 16, 2019 in an open Elasticsearch server that had 4 billion user accounts inside of over 4TB of data. There were 1.2 billion unique people discovered inside of the leak, residing on an unprotected and totally-open Elasticsearch server with no password or any means of authentication protecting it -- so you could just download all 4TB of it easily.

The data in question comes from two brokerages, with California-based People Data Labs selling the data to advertisers who could use them for commercial purposes. User content to use this data commercially has not been approved, according to Troia. This particular data set has 622 million email addresses, 50 million unique phone numbers, and a bunch of different details from social media platforms.

A cybersecurity company has released its annual Voice Intelligence Report, and their numbers are quite shocking.

According to Pindrop's annual Voice Intelligence Report, voice fraud continues to be a major threat for people as the report finds that between 2014 and 2018 fraud rates have climbed by 350%. The report also mentions the fraud rate for 2018, and it says, "The 2018 fraud rate is 1 in 685, remaining at the top of a five-year peak".

So, what type of voice fraud is occurring? The report mentions that insurance voice fraud has been the main target with widespread increases by 248%. The industries facing the highest fraud risks include insurance with 1 in 7,500 fraudulent calls, retail with 1 in 325 fraudulent calls, banking with 1 in 755 fraudulent calls, card issuers with 1 in 740 fraudulent calls, brokerages with 1 in 1,742 fraudulent calls, and credit unions with 1 in 1,339 fraudulent calls.

Another day, another data breach. Or at least that's what it feels like when you keep up with cyber-security news. This time its not really that surprising though, as a porn website had its entire data base freely open.

Condition:Black, a cyber-security and internet freedom firm discovered that a network of camgirl websites had exposed databases. The sites run by Barcelona-based VTS Media, include amateur.tv, webcampornoxxx.net, and placercams.com. While most of the users were found to be based in Europe, some data logins were found to be in the Untied States and around the world.

What kind of data was exposed? According to Techcrunch, the database contained a month-worth of daily logs, those logs included: Usernames, IP addresses, viewing habits, private chats, failed login attempts and even some details of sex workers. It isn't clear if the data base had been hacked and the data stolen, but since its discovery it has been locked down.

If you watch porn Down Under, you might need to scan your face to get your rocks off in the future... with Australia's Department of Home Affairs seemingly aroused over the idea of scanning your face to verify your age before you can access porn or gambling websites.

The new system is called "The Capability" and feels like it's ripped right out of Fringe, The X-Files and 1984 combined -- and even though the Department of Home Affairs said the facial recognition system is not functional, it is still floating the idea to Parliament in Australia that would change things in a big way for Australians porn and gambling habits.

The department said that its Document Verification Service and Face Verification Service which is used to fight regular crime and identify theft, could be enabled and used by authorities for age verification. The parliamentary submission explains: "This could assist in age verification, for example by preventing a minor from using their parent's driver licence to circumvent age verification controls".