Joe Warminsky – Page 7 – WindowsTechs.com

Grindr faces fine of nearly $12 million in Norway for alleged privacy violations

Posted on January 27, 2021 by Joe Warminsky

Norway’s data protection agency is proposing a fine of $11.7 million against Grindr for the alleged improper sharing of users’ data to third-party companies for marketing purposes. The Norwegian Data Protection Authority (DPA) said Tuesday that Grindr, which bills itself as “the world’s leading LGBTQ+ social application,” had shared, without full consent, users’ GPS locations, profile data and other information with other companies. Grindr has until Feb. 15 to argue against the decision. The case, which applies to the free version of the app, originated with a 2020 complaint from the Norwegian Consumer Council, and it falls under Europe’s General Data Protection Regulation (GDPR). The DPA said the fine of 100 million Norwegian kroner would represent its largest ever, reflecting that “our findings suggest grave violations of the GDPR.” “Users were not able to exercise real and effective control over the sharing of their data,” the Norwegian authority says. The […]

The post Grindr faces fine of nearly $12 million in Norway for alleged privacy violations appeared first on CyberScoop.

Continue reading Grindr faces fine of nearly $12 million in Norway for alleged privacy violations→

Fake Twitter personas, bogus blog delivered North Korea-linked malware to researchers

Posted on January 26, 2021 by Joe Warminsky

Hackers linked to North Korea targeted cybersecurity researchers through a seemingly legitimate research blog and friendly social media accounts, Google said Monday. The goal of those social engineering techniques was simple: Earn trust, and then trick researchers into interacting online with files that implanted file-stealing malware on their computers. There were also a few cases where unwitting researchers’ machines were infected simply by direct interaction with the security blog, Google said. That part of the campaign worked even if the researchers were using “fully patched and up-to-date Windows 10 and Chrome browser versions,” according to Google’s Threat Analysis Group. Google’s findings serve as a reminder that even the most security-minded people can still be vulnerable in the digital realm. The hacking campaign preyed upon the natural inclination of many researchers to collaborate on projects and share findings. For a nation-state trying to expand its arsenal of hacking tools, anyone with […]

The post Fake Twitter personas, bogus blog delivered North Korea-linked malware to researchers appeared first on CyberScoop.

Continue reading Fake Twitter personas, bogus blog delivered North Korea-linked malware to researchers→

Vault 7 suspect Joshua Schulte says pretrial conditions are ‘worse than death’

Posted on January 25, 2021 by Joe Warminsky

The former CIA employee charged with leaking details about agency hacking tools says he is being held under “barbaric and inhumane” conditions in a Manhattan federal facility as he awaits a second trial in the case. Lawyers for Joshua Schulte filed a petition last week on his behalf asking a New York federal judge to force the Bureau of Prisons to improve conditions at the Metropolitan Correction Center (MCC). The 32-year-old software engineer has been in solitary confinement for more than two years, according to the documents. He is accused of providing the so-called Vault 7 files, which detailed the U.S. government’s offensivie hacking capabilities, to WikiLeaks, which published the documents in 2017. “It is barbaric and inhumane to lock human beings into boxes for years and years — it is a punishment worse than death and there is no wonder that MCC inmates would rather kill themselves than continue […]

The post Vault 7 suspect Joshua Schulte says pretrial conditions are ‘worse than death’ appeared first on CyberScoop.

Continue reading Vault 7 suspect Joshua Schulte says pretrial conditions are ‘worse than death’→

Intel says financial graphic was ‘hacked,’ forcing early release of 2020 report

Posted on January 22, 2021 by Joe Warminsky

Even the leak of a single infographic can be a big deal for a major corporation. Intel Corp. had to act fast Thursday afternoon when it discovered that an infographic from its unpublished quarterly report had been circulating outside the company. As a result, the chipmaker posted those fourth quarter 2020 financial results a few minutes before the stock market closed at 4 p.m., instead of afterward. Chief Financial Officer George Davis told the Financial Times that the graphic had been “hacked” from the company’s public relations newsroom website. Intel has not specified who the thief might be, or where the graphic had been illicitly shared online. As financial cybercrime goes, the incident appears to be small and isolated, but it highlights the appeal of financial data — even a single page from a slide deck — to anyone inclined to use illicitly acquired information to get a leg up […]

The post Intel says financial graphic was ‘hacked,’ forcing early release of 2020 report appeared first on CyberScoop.

Continue reading Intel says financial graphic was ‘hacked,’ forcing early release of 2020 report→

A phishing campaign’s collateral damage: Stolen passwords were publicly searchable

Posted on January 21, 2021 by Joe Warminsky

A phishing campaign that targeted multiple industrial sectors in 2020 was messier than the average cybercrime operation. The perpetrators stole more than a thousand sets of credentials from corporate employees and then accidentally exposed that data on the public internet, according to a blog post from cybersecurity firm Check Point. The attackers made a “simple mistake in their attack chain,” the researchers said, by not securing the files once they were posted to sites set up to receive stolen data. The end result was an otherwise successful hacking operation that could have been undercut by sloppiness: A victim or an identity theft prevention system could have stumbled upon the breached data; or another set of crooks could have found the stolen credentials before the original attackers had a chance to sell or use them. “We found that once the users’ information was sent to the drop-zone servers, the data was […]

The post A phishing campaign’s collateral damage: Stolen passwords were publicly searchable appeared first on CyberScoop.

Continue reading A phishing campaign’s collateral damage: Stolen passwords were publicly searchable→

Health insurer Excellus penalized $5.1M by HHS for data breach

Posted on January 19, 2021 by Joe Warminsky

The Department of Health and Human Services says New York health insurer Excellus has agreed to pay a multimillion-dollar penalty after a data breach exposed sensitive information about more than 9 million people between late 2013 and May 2015. The $5.1 million fine is for violations of privacy and security rules under the Health Insurance Portability and Accountability Act (HIPAA), according to the department’s Office for Civil Rights (OCR). The incident stemmed from a hack against Excellus’ systems during an era that featured well-publicized attacks on corporations such as Target, Sony and Home Depot. Years later, health data remains a ripe target for cybercriminals, particularly ransomware gangs. U.S. federal agencies warned about an “imminent” ransomware threat in October 2020. The OCR said the breached data included names, addresses, dates of birth, email addresses, Social Security numbers, bank account information, health plan claims and clinical treatment information. “The hackers installed malware […]

The post Health insurer Excellus penalized $5.1M by HHS for data breach appeared first on CyberScoop.

Continue reading Health insurer Excellus penalized $5.1M by HHS for data breach→

Iran-linked spies used Christmas as cover for spearphishing, researchers say

Posted on January 14, 2021 by Joe Warminsky

A cyber-espionage group linked to the Iranian government timed a mobile phishing campaign with the Christmas holidays, using email and text messages to target individuals at think tanks, universities and elsewhere, according to new research. Known as Charming Kitten, APT35 or Phosphorous, the group sent fake text messages from “Google Account Recovery” and fake emails with Christmas content, reports the cybersecurity organization CERFTA, which specializes in Iran-related research. The goal was to use malicious web pages to capture login credentials and “steal sensitive data from their victims,” CERTFA said. “The group started the new round of attacks at a time when most companies, offices, organizations, etc. were either closed or half-closed during Christmas holidays and, as a result, their technical support and IT departments were not able to immediately review, identify, and neutralize these cyber incidents,” CERTFA says. “Charming Kitten has taken full advantage of this timing to execute its […]

The post Iran-linked spies used Christmas as cover for spearphishing, researchers say appeared first on CyberScoop.

Continue reading Iran-linked spies used Christmas as cover for spearphishing, researchers say→