Unwanted Windows 10 update wins woman $10,000 from Microsoft

The Seattle Times reports:

A few days after Microsoft released Windows 10 to the public last year, Teri Goldstein’s computer started trying to download and install the new operating system.

The update, which she says she didn’t authorize, failed. Instead, the computer she uses to run her Sausalito, Calif., travel-agency business slowed to a crawl. It would crash, she says, and be unusable for days at a time.

“I had never heard of Windows 10,” Goldstein said. “Nobody ever asked me if I wanted to update.”

When outreach to Microsoft’s customer support didn’t fix the issue, Goldstein took the software giant to court, seeking compensation for lost wages and the cost of a new computer.

She won. Last month, Microsoft dropped an appeal and Goldstein collected a $10,000 judgment from the company.

There is no doubt that Microsoft has taken its aggressive pushing of Windows 10 onto users’ computers too far, with many users claiming that it has been installed on their PCs without their explicit consent.

If a malicious hacker made unauthorised changes to your computer without your permission you would expect the police to take an interest.

So what makes it any different when it’s a company called Microsoft messing around with your computer?

Continue reading Unwanted Windows 10 update wins woman $10,000 from Microsoft→

Malware on Google Play steals Viber photos and videos

Symantec reports:

Symantec has discovered an app on Google Play that steals photos and videos from the popular social media app Viber. Beaver Gang Counter masquerades as a score keeping app for a popular card game but secretly searches for media files related to the Viber app and sends them to a remote server.

It’s easy to imagine who the personal photos and videos stolen by this malware could be used by online criminals for the purposes of blackmail, stalking, fraud, identity theft or just good old-fashioned voyeurism.

Interestingly, it seems that Beaver Gang Counter waited for instructions from a remote command and control (C&C) server before scooping up personal photos and videos. This functionality appears to have helped the malware waltz past the Google Play store’s vetting process.

Malware on the Android platform is a growing problem, but it’s even worse when it makes its way into the official Android app store.

Symantec says that Google has now removed the offending app and developer from Google Play, but one wonders how long it will be before someone else attempts something similar.

Continue reading Malware on Google Play steals Viber photos and videos→

VASCO explains how to secure data access within the Healthcare industry

VASCO explains how to secure data access within the Healthcare industry

Graham Cluley Security News is sponsored this week by the folks at VASCO Data Security. Thanks to the great team there for their support!

VASCO, a global leader in authentication, electronic signatures, and identity management, is sharing its expertise in a new free white paper: “Securing Data Access Within the Healthcare Industry”.

The integration of technology within the healthcare sector continues to create seismic changes in how individuals receive medical care. Yet in their rush to adopt technology designed to improve the consumer’s experience, organizations within the healthcare industry face the very real threat of sensitive patient data ending up in the hands of cybercriminals.

When it comes to the value of stolen data within the criminal underground, the more personal the better – and it does not come any more personal than protected health information (PHI) included in medical records. In the hands of criminals, PHI facilitates all types of crimes including prescription fraud, identity theft and the provision of medical care to a third party in the victim’s name.

Despite its compromised state, there is more value attached to healthcare-related data than other types of personally identifiable information. A stolen credit card, for example, has a finite life because once the customer discovers fraud they cancel the card. PHI, on the other hand, contains government-issued identity numbers such as national insurance numbers, as well as medical and prescription-related data that are permanent.

Security cannot remain an afterthought. Breaches negatively impact the patient and the broader healthcare ecosystem.

Download VASCO’s free white paper now, and learn how to secure data access within the Healthcare industry!


If you’re interested in exclusively sponsoring my site for a week, and reaching an IT-savvy audience that cares about computer security, you can find more information here.

Continue reading VASCO explains how to secure data access within the Healthcare industry→

Comodo stands down from trademark tussle with Let’s Encrypt

Looks like Comodo has had second thoughts about entering a trademark dispute over the term “Let’s Encrypt”, as Steve Ragan at CSO Online reports:
A Comodo staffer, Robin Alden, said that the company had abandoned their let’s encrypt trademarks.
“Comodo… Continue reading Comodo stands down from trademark tussle with Let’s Encrypt→

Scam victim sues TalkTalk

The Mirror reports on Michael Robinson, who is taking British broadband provider TalkTalk to court after they were hacked and he suffered at the hands of scammers:

Mr Robinson, of Whitburn, near Edinburgh, who is claiming “substantial” compensation said: “We have suffered mentally.”

TalkTalk reveal more than 150,000 customers and 15,000 bank accounts hacked

He says the crooks also got hold of his wife’s details and photos of his children.

His bank refunded £257 after a conman called, saying he was from TalkTalk.

TalkTalk said: “Scammers only had minimal, inconsequential information.”

Minimal? Inconsequential? Hmm. Personally, I think minimal information would have been zero.

The scammers exploited information about TalkTalk customers (including names, dates of birth, address, email address, phone numbers, full bank account numbers and sort codes) seemingly stolen through an elementary SQL injection attack on the TalkTalk website.

In the hands of a criminal such information can easily be used in a scam telephone call to trick the unwary into believing they are talking to a member of TalkTalk staff.

TalkTalk, however, only offered to waive affected customers’ termination fees if victims could show that they had lost money as a direct result of the information above being stolen, not as a consequence of a subsequent scam phone call using the sensitive data.

TalkTalk would be wise to consider that trust takes years to build, seconds to lose, and a lifetime to regain (if you’re lucky).

Every one of those scammed customers will never use TalkTalk again, will tell all of their friends and family never to use TalkTalk, and some may even – like Michael Robinson – be tempted to seek financial redress through the courts.

Continue reading Scam victim sues TalkTalk→