Tag: privacy

bookmark_borderWawa Data Breach

Posted on by admin

In December of 2019, Wawa admitted to a security breach that affected 30 million consumers. The credit card and debit card transactions in their stores, as well as, their gas pumps had been stolen for many months. Wawa is a privately owned company which makes it difficult to determine their sales and security. It is known that Wawa is the largest convenience store chain in the greater Philadelphia area with sales over $10 billion dollars. 645 Wawa locations in New Jersey, Pennsylvania, Delaware, Maryland, Virginia and Florida.

Wawa headquarters are located in Wawa, Pennsylvania. Wawa is an indigenous American word for “flying goose”; however, Wawa customer may feel they got a giant goose egg.

Krebs On Security reports, Wawa Breach May Have Compromised More Than 30 Million Payment Cards. “On the evening of Monday, Jan. 27, a popular fraud bazaar known as Joker’s Stash began selling card data from “a new huge nationwide breach” that purportedly includes more than 30 million card accounts issued by thousands of financial institutions across 40+ U.S. states.
28
Jan 20
Wawa Breach May Have Compromised More Than 30 Million Payment Cards

In late December 2019, fuel and convenience store chain Wawa Inc. said a nine-month-long breach of its payment card processing systems may have led to the theft of card data from customers who visited any of its 850 locations nationwide. Now, fraud experts say the first batch of card data stolen from Wawa customers is being sold at one of the underground’s most popular crime shops, which claims to have 30 million records to peddle from a new nationwide breach.

On the evening of Monday, Jan. 27, a popular fraud bazaar known as Joker’s Stash began selling card data from “a new huge nationwide breach” that purportedly includes more than 30 million card accounts issued by thousands of financial institutions across 40+ U.S. states.

The fraud bazaar Joker’s Stash on Monday began selling some 30 million stolen payment card accounts that experts say have been tied back to a breach at Wawa in 2019.

Two sources that work closely with financial institutions nationwide tell KrebsOnSecurity the new batch of cards that went on sale Monday evening — dubbed “BIGBADABOOM-III” by Joker’s Stash — map squarely back to cardholder purchases at Wawa.”

More on Security

bookmark_borderHow do Websites Know what Device I’m Logged in with?

Posted on by admin

I asked: how do Amazon and some of these banks know what device I’m logged in with? Is it strictly cookies? or MAC address, too? or…?

Sidd replied: heehee, are you running an app or your web browser ? windows or phone ?

There are a million ways, there is a GUID associated with your CPU, there is a list of fonts installed, browser release version, OS version, the list goes on. You got to jump thru a million hoops to avoid leakage, and if you do it well enuf they might not let you log in.

bookmark_borderFacebook Hack and Facebook Messenger App.

Posted on by admin

By Daniel Brouse

In late September, Facebook acknowledged having 50 million accounts hacked; however, Facebook has not been forthcoming with answers or a response. To the best of our knowledge, Facebook has not notified any of the victims. Facebook said, “On the afternoon of Tuesday, September 25, our engineering team discovered a security issue affecting almost 50 million accounts.”

CNN reported, “On Sunday, September 16, engineers at Facebook detected some unusual activity on the social media platform’s networks. It was an attack, the biggest security breach in Facebook’s history. And it would take the company 11 more days to stop it.

Now, almost a week since the public was first told of the attack, we still barely know anything about what happened.”

The hackers were able to use a Facebook feature (“View As”) to access anyone’s account that was left logged in (typically cell phones, Ipads, etc.)

Within a week, a viral “hoax” was used to exploit a known vulnerability in the Facebook messenger app. The Facebook messenger app has never been secure. The app is different than the messenger feature on the computer version of Facebook. The unsecure app is a separate app that is installed on phones and similar devices. The Facebook messenger app should be uninstalled and not reinstalled. Only use the Facebook messenger when logged on  through a computer that does not use the app.

The viral hoax is probably part 2 of the hack. If you are getting the messages, it’s likely you have been hacked and are sending the hoax to yourself. The messages are to further verify your account for the hackers, as well as, spread your breach through a known fb messenger app exploit.

Less than 1% of the messages are sent by humans. If you are getting the messages from people on your friends list, your friends list was more than likely compromised.

About the 50 million accounts that were hacked, the FTC recommends:

October 3, 2018

by

Lisa Weintraub Schifferle
Attorney, FTC, Division of Consumer and Business Education

Facebook recently announced the largest breach in the company’s history. The breach affected about 50 million users, allowing hackers to take over their accounts. If you use Facebook, you may be wondering what to do next. Here are a few steps you can take.

First, you probably want to know more about the breach. According to Facebook, the attackers took advantage of a weakness in the “View As” feature, which lets people see what their profile looks like to others. The hackers stole digital keys that keep you logged in to Facebook so you don’t need to re-enter your password every time. Facebook says they’ve fixed the vulnerabilities and reset digital keys on 50 million affected accounts, plus an additional 40 million accounts that used the “View As” function.

To better protect yourself after this breach:

  • Watch out for imposter scams. With access to your Facebook account, hackers can get a lot of information about you. That information could be used to impersonate people you know or companies you do business with. If someone calls you out of the blue, asking for money or personal information, hang up. Then, if you want to know for sure if the person calling you was really your family member or was really from a company you know and trust, call them back at a number you know to be correct before you give any information or money. And remember: anyone who demands that you pay by gift card or by wiring money is scamming you. Always.
  • Consider changing your password. Facebook says that it fixed the vulnerability, so there’s no need to change your password. But, to be safe, log in and change your password anyway. If you use the same password other places, change it there, too. Don’t forget to change your security questions, as well – especially if the answers include information that could be found in your Facebook account.

For more information about what to do after a data breach, visit IdentityTheft.gov/databreach and watch the FTC’s video on What to Do After a Data Breach.

If you learn that someone has misused your personal information, go to IdentityTheft.gov to report identity theft and get a personal recovery plan. Because recovering from identity theft – and data breaches – is easier with a plan.

Computer Internet Security, Privacy and Safety

bookmark_borderInternet Privacy

Posted on by admin

The information on how the Trump campaign obtained and exploited citizens’ privacy should serve as an example to your personal responsibility in maintaining internet security.

Do not use any Facebook game, IQ test, quiz or other third-party APP’s (applications). Never give permission allowing a third party access to your personal information. Shame on you if you allow your friends information to be accessed!

The BBC reported, “In 2014, Facebook invited users to find out their personality type via a quiz developed by Cambridge University researcher Dr Kogan called This is Your Digital Life.”

The personality quiz was used to exploit users personal information, as well as, all your friends’ personal information. Your (and your friends’) information was then sold through Cambridge Analytica to the Trump campaign and used to exploit you.

WHAT CAN YOU DO TO HELP PROTECT YOUR PRIVACY?

Privacy suggestions:
1) change your default Facebook settings (make sure you never share your friends info. by default)
2) clear your web browser’s cookies on a regular basis
3) install an ad blocker
For example, using FireFox web browser with the AdBlock Add-on
https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/
OR
1) just use TOR browser Download the Tor browser (free)

MORE: Virtual Private Network and Internet Privacy

bookmark_borderUber Paid Ransom and Hid Hack

Posted on by admin

Uber Paid Hackers to Delete Stolen Data on 57 Million People

* Company paid hackers $100,000 to delete info, keep quiet
* Chief Security Officer Joe Sullivan and another exec ousted

Bloomberg reports, that Uber was hacked of personal data from 57 millions drivers and riders. Then, instead of reporting the crime, they paid extortion to the criminals and hid the breach.

“None of this should have happened, and I will not make excuses for it,” Dara Khosrowshahi, who took over as chief executive officer in September, said in an emailed statement. “We are changing the way we do business.”

Travis Kalanick, Uber’s co-founder and former CEO, learned of the hack in November 2016, a month after it took place, the company said. Uber said it was obligated to report the hack of driver’s license information and failed to do so.

“At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals,” Khosrowshahi said. “We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage accounts.”

bookmark_borderHuge Credit Agency Data Breach

Posted on by admin

by Daniel Brouse and Sidd Mukherjee for Membrane Domain Security

Equifax is one of the largest credit reporting agencies in the world. Ironically, Equifax provides “identity protection tools with daily monitoring and alerts today!”

From May to July, 2017, Equifax allowed a cybersecurity breach to steal 143 million people’s identity. The stolen information includes social security numbers, birthdays, addresses and driver’s license numbers.

On September 7, Equifax released a statement via Twitter: “We recently discovered a cybersecurity incident involving consumer information. Once discovered, we acted immediately to stop the intrusion. We apologize to our consumers and business customers for the concern and frustration this causes. Learn more: .”

The data breach compromised about half the population of the United States.

Cyber security specialist Sidd Mukherjee said, “The main issue not addressed is the collection of the data in the first place. There would be no target if there were no centralized database. If the data were maintained in a distributed mechanism, with strict privacy guarantees and guaranteed update (such as blockchain/bittorent/tor allows) we would not be in this situation.

‘But that’s so hard and we need to make money this quarter’

OK, that is actually quite a cruel summary, so let me expand. Back in the day, centralized was the only way to go. The Internet made a lot of things possible and mathematics did as much. Companies like Equifax began in response to a need. They
glommed on to a need twenty years before the Internet and made big databases because they watched ATT and SABRE and railroads, and such. The Internet came along and they lumbered over. And now, they find they are in a strange and terrible land beset with pitfall and with snare.

Equifax makes money through collection and controlled distribution of data. Both those avenues and control are threatened in this brave new world, as Mr. Assange pointed out some time ago.

Don’t get me wrong. I actually think assaults on privacy have done the evolution thing, selected for those schemes which resist assault. And as such, the centralized databases will get selected out of the game. It will take a while, though.”

In other news, until you had many to many communication with latency lower than human attention span, which seems to be about 20 seconds, you can’t really do hive intelligence like the kids are doing with the cell phones. Watch the kids. Demographic is destiny, as someone said.”

bookmark_borderVPN: Virtual Private Network and Internet Privacy

Posted on by admin

by Daniel Brouse and Sidd Mukherjee

Your Internet service provider (ISP) knows where you live, your address and billing info. They also know:

  • all the IPs and domain names you visit and when
  • all the content of your unencrypted traffic in and out, as well as, the timing

The federal government now allows your ISP to sell the information.

VPN: Virtual Private Network
VPN stands for virtual private network. A VPN builds an encrypted connection from your computer to your VPN provider and routes all your traffic through it. All your traffic now appears on the net through the IP of your VPN provider.

If you use a VPN, the only thing others can see is you making an encrypted connection to one IP that relays your traffic. If that IP is at the same location as you, you are still subject to a geolocation threat.

In addition to using a VPN, the following is recommended:

TURN OFF Cookies And Java
The easiest way to start protecting your privacy is turning off cookies and java in your browser. Cookies allow remote servers access to your internet activities. Your browser history is also subject to privacy violations. Only allow access to your cookies and browser history when you are confident of the websites you visit. If a site forces you to use cookies, clear your cookies and browser history after each visit.

Java and Java script allow remote servers to run programs on your computer. Java script is how most malware is downloaded onto your computer. Avoid Java at all costs.

AdBlock – Chrome
Advertisement blocking software can be added to most web browsers. AdBlock for Google’s Chrome is one of the highest rated. Google says, “AdBlock. The #1 ad blocker with over 200 million downloads. Blocks YouTube, Facebook and ads everywhere else on the web. The original AdBlock for Chrome works automatically. Choose to continue seeing unobtrusive ads, whitelist your favorite sites, or block all ads by default. Just click “Add to Chrome,” then visit your favorite website and see the ads disappear!”

IP Anonymizer
Protecting the privacy of your unique IP is the most important aspect of protecting your privacy. It is also fairly difficult. A VPN does not conceal your IP on the Internet.

The easiest and cheapest way to conceal your identity is with an IP Anonymizer. “This anonymizer will hide your IP address from the websites you access as well as protect you from tracking with cookies and other means.”

You can go to a site, such as, http://webanonymizer.org/ and enter the website you want to visit. WebAnonymizer will automatically mask your IP for free.

TOR
A Tor browser is free software for enabling anonymous communication. The Tor name is an acronym for the original software project name “The Onion Router”. Tor routes Internet traffic through a free, worldwide, volunteer network of more than seven thousand relays. A users location and usage is concealed from anyone conducting network surveillance or traffic analysis. Tor makes it very difficult for Internet activity to be traced including “visits to Web sites, online posts, instant messages, and other communication forms”.

The Tor project states, “The Tor software protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, it prevents the sites you visit from learning your physical location, and it lets you access sites which are blocked. Tor Browser lets you use Tor on Windows, Mac OS X, or Linux without needing to install any software. It can run off a USB flash drive, comes with a pre-configured web browser to protect your anonymity, and is self-contained (portable).”

Download the Tor browser (free)

Comments
A reader asked: So is there still a place for a VPN on our mobile devices? When using public wifi for example?
A: Yes. Almost all public wifi’s are a private network. You just have to worry about the other people who are on the private network with you. A device on the private network is easily hacked by someone in close proximity (e.g. hackers can use a Pringles can as an antenna and gain access within several hundred yards http://www.lifehack.org/articles/lifehack/extend-your-wifi-range-using-diy-antenna-from-pringles-can.html)

From The Membrane Domain’s Cybersecurity Center

bookmark_borderBig Brother Is Watching: FBI and NSA Spying on You

Posted on by admin

Two newspapers, The Washington Post and the Guardian (UK), have published articles about the United States government invading the civil rights of its own citizens. The information was obtained from a “top secret” document and states that the National Security Agency and the FBI are collecting information directly from the servers of Microsoft, Yahoo, Google, Facebook, PalTalk, AOL, Skype, YouTube, Apple.

 

The National Security Agency and the FBI are tapping directly into the central servers of nine leading U.S. Internet companies, extracting audio and video chats, photographs, e-mails, documents, and connection logs that enable analysts to track foreign targets, according to a top-secret document obtained by The Washington Post.

 

Find out about connecting to the Internet through a secure private server.

More on cyber security and privacy.

bookmark_borderGood News: FaceBook IPO Flops

Posted on by admin

The initial puplic offering of FaceBook flopped on the NASDAQ. This is good news. It is rumored that the sinister bad bank Morgan Stanley had to eat it. When the offering price failed, the bad bankers had to come in and prop up the price. As it turns out, Mark Zuckerberg may be one of the largest criminals in our times. Just say NO to proping up sketchy shysters.

bookmark_borderDear Mark Zuckerberg

Posted on by admin

Dear Mark Zuckerberg,

It is my understanding that you have stolen my Intellectual Property Rights, as well as, a host of other crimes. I can prove that you have stolen my property… and, I want my money back. More importantly, I have many friends. You have stolen from them, too.

In the process of your theft, you committed many other even more serious crimes having to do with basic human rights, the Constitution of the United States of America (including the Bill Of Rights) and a multitude of specific local criminal activity.

Not only do we want our money back, we insist on additional restitution and time in jail.

Please turn yourself in.

Thank you,
Victim

PS Are your evil ways why you, and your friends, spend so much of our money on private protection and security… while you are violating ours?

About The Need For Security.

This is a reference to the Mayor of New York’s Bloomsberg report  pointing out the most stockholder money being spent on personal security. The only person mentioned spending more:

Zynga Outspends Many To Protect CEO Pincus

Why are these guys so afraid?

Independent resource The Wall Street Journal

http://online.wsj.com/article/BT-CO-20120409-707108.html

online.wsj.com

From time to time, we will send you e-mail announcements on new features and special offers from The Wall Street Journal Online.