Category: Security

Computer, Internet and network security, privacy and safety.

bookmark_borderThe Link Between GDP and Immigration

Posted on by admin

by Daniel Brouse
January 31, 2025

In the most recent quarter, the U.S. GDP experienced a decline, coinciding with historically low levels of immigration over the past few quarters. This is not a coincidence—there is a well-documented and direct relationship between economic growth and immigration. In modern times, immigration has accounted for approximately 80% of GDP growth, as new workers, consumers, and entrepreneurs contribute to economic expansion, productivity, and innovation.

With the current restrictive immigration policies, the U.S. economy faces a significant risk of contraction. A shrinking labor force leads to slower business growth, increased labor shortages, and reduced consumer demand—all of which hinder GDP expansion. Additionally, declining immigration reduces the number of younger workers paying into Social Security and Medicare, exacerbating long-term fiscal challenges.

If current trends continue, the economy is expected to suffer severe negative consequences, including slower growth, rising inflationary pressures due to labor shortages, and weakened global competitiveness. Addressing immigration policy is not just a social or political issue—it is an economic imperative.

ADDITIONAL RESOURCES

Economic Outlook

Trump’s Proposed Tariffs on Mexico and Canada: A Policy Analysis

Economic Facts on Immigration, Budget Deficits and Inflation

Immigration and the Wage Inflation Spiral

The True Costs (and Benefitlessness) of a Trump Economy

bookmark_borderDaniel Brouse: About the Author

Posted on by admin

Q: Any background on membrane .com?

A: In 1994, I started a publishing company with another scientist (low temperature physicist and co-builder of the Ohio States supercomputer). The name of the publishing company is The Philadelphia Spirit Experiment. As the name suggests, it is a scientific experiment in the publishing of arts and science. At the time, domain names were free and the world wide web was 6 months old. We wanted a name that both rhymed and made a good scientific pun — everything passes through the Membrane Domain. The KingArthur.com anti-IQ test launched in 1995.

We were the first record company, fine arts, science, technology, math, and engineering publisher on the web. As such, we were the first to analize web traffic. Our monthly audience is over 300 million. Innovations include: the clickable button on a webpage, MP3 distribution, pay-per-download, free streaming music, the web-based video… and interactive games to save the planet (including a $1,000,000 prize to solve the Anthropogenic Global Warming problem.

My areas of expertise include: musicology, geology, meteorology, anthropology, biology, health & wellness, sociology, security, climate change, physics, finance, economics, statistics, computer science, data science, chaos theory, political science, publishing, logic, and philosophy. In general, my aptitude is in science, technology, engineering, and math.

— Daniel Brouse

bookmark_borderWawa Data Breach

Posted on by admin

In December of 2019, Wawa admitted to a security breach that affected 30 million consumers. The credit card and debit card transactions in their stores, as well as, their gas pumps had been stolen for many months. Wawa is a privately owned company which makes it difficult to determine their sales and security. It is known that Wawa is the largest convenience store chain in the greater Philadelphia area with sales over $10 billion dollars. 645 Wawa locations in New Jersey, Pennsylvania, Delaware, Maryland, Virginia and Florida.

Wawa headquarters are located in Wawa, Pennsylvania. Wawa is an indigenous American word for “flying goose”; however, Wawa customer may feel they got a giant goose egg.

Krebs On Security reports, Wawa Breach May Have Compromised More Than 30 Million Payment Cards. “On the evening of Monday, Jan. 27, a popular fraud bazaar known as Joker’s Stash began selling card data from “a new huge nationwide breach” that purportedly includes more than 30 million card accounts issued by thousands of financial institutions across 40+ U.S. states.
28
Jan 20
Wawa Breach May Have Compromised More Than 30 Million Payment Cards

In late December 2019, fuel and convenience store chain Wawa Inc. said a nine-month-long breach of its payment card processing systems may have led to the theft of card data from customers who visited any of its 850 locations nationwide. Now, fraud experts say the first batch of card data stolen from Wawa customers is being sold at one of the underground’s most popular crime shops, which claims to have 30 million records to peddle from a new nationwide breach.

On the evening of Monday, Jan. 27, a popular fraud bazaar known as Joker’s Stash began selling card data from “a new huge nationwide breach” that purportedly includes more than 30 million card accounts issued by thousands of financial institutions across 40+ U.S. states.

The fraud bazaar Joker’s Stash on Monday began selling some 30 million stolen payment card accounts that experts say have been tied back to a breach at Wawa in 2019.

Two sources that work closely with financial institutions nationwide tell KrebsOnSecurity the new batch of cards that went on sale Monday evening — dubbed “BIGBADABOOM-III” by Joker’s Stash — map squarely back to cardholder purchases at Wawa.”

More on Security

bookmark_borderHow do Websites Know what Device I’m Logged in with?

Posted on by admin

I asked: how do Amazon and some of these banks know what device I’m logged in with? Is it strictly cookies? or MAC address, too? or…?

Sidd replied: heehee, are you running an app or your web browser ? windows or phone ?

There are a million ways, there is a GUID associated with your CPU, there is a list of fonts installed, browser release version, OS version, the list goes on. You got to jump thru a million hoops to avoid leakage, and if you do it well enuf they might not let you log in.

bookmark_borderFacebook Hack and Facebook Messenger App.

Posted on by admin

By Daniel Brouse

In late September, Facebook acknowledged having 50 million accounts hacked; however, Facebook has not been forthcoming with answers or a response. To the best of our knowledge, Facebook has not notified any of the victims. Facebook said, “On the afternoon of Tuesday, September 25, our engineering team discovered a security issue affecting almost 50 million accounts.”

CNN reported, “On Sunday, September 16, engineers at Facebook detected some unusual activity on the social media platform’s networks. It was an attack, the biggest security breach in Facebook’s history. And it would take the company 11 more days to stop it.

Now, almost a week since the public was first told of the attack, we still barely know anything about what happened.”

The hackers were able to use a Facebook feature (“View As”) to access anyone’s account that was left logged in (typically cell phones, Ipads, etc.)

Within a week, a viral “hoax” was used to exploit a known vulnerability in the Facebook messenger app. The Facebook messenger app has never been secure. The app is different than the messenger feature on the computer version of Facebook. The unsecure app is a separate app that is installed on phones and similar devices. The Facebook messenger app should be uninstalled and not reinstalled. Only use the Facebook messenger when logged on  through a computer that does not use the app.

The viral hoax is probably part 2 of the hack. If you are getting the messages, it’s likely you have been hacked and are sending the hoax to yourself. The messages are to further verify your account for the hackers, as well as, spread your breach through a known fb messenger app exploit.

Less than 1% of the messages are sent by humans. If you are getting the messages from people on your friends list, your friends list was more than likely compromised.

About the 50 million accounts that were hacked, the FTC recommends:

October 3, 2018

by

Lisa Weintraub Schifferle
Attorney, FTC, Division of Consumer and Business Education

Facebook recently announced the largest breach in the company’s history. The breach affected about 50 million users, allowing hackers to take over their accounts. If you use Facebook, you may be wondering what to do next. Here are a few steps you can take.

First, you probably want to know more about the breach. According to Facebook, the attackers took advantage of a weakness in the “View As” feature, which lets people see what their profile looks like to others. The hackers stole digital keys that keep you logged in to Facebook so you don’t need to re-enter your password every time. Facebook says they’ve fixed the vulnerabilities and reset digital keys on 50 million affected accounts, plus an additional 40 million accounts that used the “View As” function.

To better protect yourself after this breach:

  • Watch out for imposter scams. With access to your Facebook account, hackers can get a lot of information about you. That information could be used to impersonate people you know or companies you do business with. If someone calls you out of the blue, asking for money or personal information, hang up. Then, if you want to know for sure if the person calling you was really your family member or was really from a company you know and trust, call them back at a number you know to be correct before you give any information or money. And remember: anyone who demands that you pay by gift card or by wiring money is scamming you. Always.
  • Consider changing your password. Facebook says that it fixed the vulnerability, so there’s no need to change your password. But, to be safe, log in and change your password anyway. If you use the same password other places, change it there, too. Don’t forget to change your security questions, as well – especially if the answers include information that could be found in your Facebook account.

For more information about what to do after a data breach, visit IdentityTheft.gov/databreach and watch the FTC’s video on What to Do After a Data Breach.

If you learn that someone has misused your personal information, go to IdentityTheft.gov to report identity theft and get a personal recovery plan. Because recovering from identity theft – and data breaches – is easier with a plan.

Computer Internet Security, Privacy and Safety

bookmark_borderCybersecurity, Russia, China Hacks and 5 Eyes

Posted on by admin

King Arthur asked sidd:

you see these?
China motherboard hack
https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies

and Russia wifi attack
Britain and the Netherlands on Thursday accused the Russian GRU military intelligence agency of a series of global cybercrimes, including attacks against the international chemical weapons watchdog
https://www.washingtonpost.com/business/technology/the-latest-dutch-gru-targeted-chemical-weapons-watchdog/2018/10/04/5664a72a-c7c1-11e8-9c0f-2ffaf6d422aa_story.html?utm_term=.e626ce36e615

sidd replied:
all the companies involved are denying the bloomberg article
but they would …

NSA intercepts equipment and bugs it too … Snowden told us that

https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/

as far as the russian attacks go, they are small time compared to giant vacuum NSA operates under the five eyes agreement:

The Five Eyes, often abbreviated as FVEY, is an intelligence alliance comprising Australia, Canada, New Zealand, the United Kingdom and the United States. These countries are parties to the multilateral UKUSA Agreement, a treaty for joint cooperation in signals intelligence.

In spite of continued controversy over its methods, the Five Eyes relationship remains one of the most comprehensive known espionage alliances in history

More Computer Internet Security, Privacy and Safety

bookmark_borderRobo Call Scams and Spoofs

Posted on by admin

Sidd said:

Briefly, the idea is this: someone calls you up
spoofs the callerid on your phone
so that your phone displays bank phone number
then they reel of a bunch of information about you
….
but they then ask for security code on card, PIN, mothers maiden name

and it’s game over

when you get a call or voicemail purporting to be from your bank
manually dial the number on your card
like with your fingers

Don’t trust the net to find the phone number for your bank
scammers have been populating search results with fake numbers

If you pick the call up and someone claims to be from the bank
say, “cool, tanx. I’m going to hang up now and call the number
I have on my card and that you claim to be from.”

https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/

Another spoof seen in the wild is getting a text message from UPS/USPS/FedEx/DHL/… with a link pretending to
be a tracking number for a package. Or an email.

If you click on that link, it goes to a website that installs malware.

Best way to handle is to write down the tracking number, go to the company web site and type it in.

other versions pretend to be your doctor/dentist/insurance company …

Careful out there, mind how you go. Give no information out to callers, and treat voicemail/email/texts with caution.

More Computer Internet Security, Privacy and Safety

bookmark_borderInternet Privacy

Posted on by admin

The information on how the Trump campaign obtained and exploited citizens’ privacy should serve as an example to your personal responsibility in maintaining internet security.

Do not use any Facebook game, IQ test, quiz or other third-party APP’s (applications). Never give permission allowing a third party access to your personal information. Shame on you if you allow your friends information to be accessed!

The BBC reported, “In 2014, Facebook invited users to find out their personality type via a quiz developed by Cambridge University researcher Dr Kogan called This is Your Digital Life.”

The personality quiz was used to exploit users personal information, as well as, all your friends’ personal information. Your (and your friends’) information was then sold through Cambridge Analytica to the Trump campaign and used to exploit you.

WHAT CAN YOU DO TO HELP PROTECT YOUR PRIVACY?

Privacy suggestions:
1) change your default Facebook settings (make sure you never share your friends info. by default)
2) clear your web browser’s cookies on a regular basis
3) install an ad blocker
For example, using FireFox web browser with the AdBlock Add-on
https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/
OR
1) just use TOR browser Download the Tor browser (free)

MORE: Virtual Private Network and Internet Privacy

bookmark_borderUber Paid Ransom and Hid Hack

Posted on by admin

Uber Paid Hackers to Delete Stolen Data on 57 Million People

* Company paid hackers $100,000 to delete info, keep quiet
* Chief Security Officer Joe Sullivan and another exec ousted

Bloomberg reports, that Uber was hacked of personal data from 57 millions drivers and riders. Then, instead of reporting the crime, they paid extortion to the criminals and hid the breach.

“None of this should have happened, and I will not make excuses for it,” Dara Khosrowshahi, who took over as chief executive officer in September, said in an emailed statement. “We are changing the way we do business.”

Travis Kalanick, Uber’s co-founder and former CEO, learned of the hack in November 2016, a month after it took place, the company said. Uber said it was obligated to report the hack of driver’s license information and failed to do so.

“At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals,” Khosrowshahi said. “We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage accounts.”

bookmark_borderThe Danger in Email, Sytlesheets, Scripts and Session Replay

Posted on by admin

Membrane Domain Security Center

https://freedom-to-tinker.com/2017/09/28/i-never-signed-up-for-this-privacy-implications-of-email-tracking/

What happens when you open an email and allow it to display embedded images and pixels? You may expect the sender to learn that you’ve read the email, and which device you used to read it. But in a new paper we find that privacy risks of email tracking extend far beyond senders knowing when emails are viewed. Opening an email can trigger requests to tens of third parties, and many of these requests contain your email address. This allows those third parties to track you across the web and connect your online activities to your email address, rather than just to a pseudonymous cookie.

How it works. Email tracking is possible because modern graphical email clients allow rendering a subset of HTML. JavaScript is invariably stripped, but embedded images and stylesheets are allowed. These are downloaded and rendered by the email client when the user views the email.[2] Crucially, many email clients, and almost all web browsers, in the case of webmail, send third-party cookies with these requests. The email address is leaked by being encoded as a parameter into these third-party URLs.

https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfiltration-of-personal-data-by-session-replay-scripts/

You may know that most websites have third-party analytics scripts that record which pages you visit and the searches you make. But lately, more and more sites use “session replay” scripts. These scripts record your keystrokes, mouse movements, and scrolling behavior, along with the entire contents of the pages you visit, and send them to third-party servers. Unlike typical analytics services that provide aggregate statistics, these scripts are intended for the recording and playback of individual browsing sessions, as if someone is looking over your shoulder.

https://motherboard.vice.com/en_us/article/59yexk/princeton-study-session-replay-scripts-tracking-you
Over 400 of the World’s Most Popular Websites Record Your Every Keystroke

Prominent companies who use the scripts include men’s retailer Bonobos.com, Walgreens.com, and the financial investment firm Fidelity.com. It’s also worth noting that 482 might be a low estimate. It’s likely that the scripts don’t record every user that visits a site, the researchers told me. So when they were testing, they likely did not detect some scripts because they were not activated. You can see all the popular websites that utilize session replay scripts documented by the researchers here.

The Walgreen’s example runs afoul of HIPPA in, oh, so many ways.

List of sites discovered (I bet many, many more are doing it)

https://webtransparency.cs.princeton.edu/no_boundaries/session_replay_sites.html

Disable all scripting. Disable images. Hell, I’m almost at the point of disabling stylesheets, that’ll be the next tracker if they aint doing it already.

I guess, just use surfraw and parse the output. Or go oldschool and lynx/links.

sidd