Category Archives: legal

Facebook rejects new allegation that it protected employees over users in 2018 breach

Posted on by

A class-action lawsuit over a 2018 breach of Facebook has another wrinkle: A new court filing reveals allegations that the social media company moved to protect its own employees from the exploited vulnerability while keeping users in the dark. Facebook called the allegation, made public Thursday, “absolutely false.” The plaintiffs’ claim centers on the company’s handling of a problem with the “access token” that lets people into their profiles without having to log in every time they visit Facebook. “Facebook knew about the access token vulnerability and failed to fix it for years, despite that knowledge,” says the court filing in the U.S. District Court for the Northern District of California. “Even more egregiously, Facebook took steps to protect its own employees from the security risk, but not the vast majority of its users.” A vulnerability in Facebook’s code allowed an attacker to steal the tokens. Facebook disclosed the breach last September, initially saying 50 million accounts were affected before […]

The post Facebook rejects new allegation that it protected employees over users in 2018 breach appeared first on CyberScoop.

Continue reading Facebook rejects new allegation that it protected employees over users in 2018 breach→

Alleged Capital One hacker may have taken data from dozens of companies, feds say

Posted on by

The person allegedly behind the recent Capital One hack may have siphoned data from more than 30 other companies, according to federal court filings made public Wednesday. In a motion for detention filed in the Western District of Washington state, the U.S. government said investigators found that Paige Thompson took data from multiple companies, and not just Virginia-based bank. The revelation was part of the evidence used to argue that Thompson must be detained before trial, or else pose a danger to the community and a risk of skipping out on further court dates. Thompson, who is currently in federal custody in Washington state, has been charged with stealing data on 106 million Capital One customers after taking advantage of a misconfigured firewall in the bank’s cloud computing system. According to the latest filing, the government has allegedly found terabytes of additional data Thompson took from more than 30 “companies, educational institutions, and […]

The post Alleged Capital One hacker may have taken data from dozens of companies, feds say appeared first on CyberScoop.

Continue reading Alleged Capital One hacker may have taken data from dozens of companies, feds say→

Pakistani man allegedly paid AT&T employees big bucks to jailbreak millions of iPhones

Posted on by

A 34-year-old Pakistani man has been charged with paying AT&T employees more than $1 million to plant malicious software that make it possible to use iPhones outside AT&T’s controls, the U.S. Department of Justice said Tuesday. Muhammad Fahd conspired with another man, Ghulam Jiwani, according to a newly unsealed indictment. The scheme, which lasted in some form from April 2012 to September 2017, involved the two men approaching AT&T employees, often through Facebook or by phone, then offering cash in exchange for the employees’ agreement to unlock specific phones, based on their identifying IMEI codes. The scheme unlocked more than 2 million cell phones over the five-year span, prosecutors say. Unlocked devices are compatible with any cell carrier, depriving “the remaining value of the customer’s service contract and, if applicable, remaining payments under the customer’s installment plan,” according to the indictment. Fahd, who also went by the name Frank Zhang, operated under […]

The post Pakistani man allegedly paid AT&T employees big bucks to jailbreak millions of iPhones appeared first on CyberScoop.

Continue reading Pakistani man allegedly paid AT&T employees big bucks to jailbreak millions of iPhones→

Cisco will pay $8.6 million to settle claims it sold US flawed surveillance software

Posted on by

Technology giant Cisco has agreed to pay $8.6 million to settle allegations it knowingly sold video surveillance equipment with security vulnerabilities to federal, state and local government agencies, according to court records unsealed Wednesday. A company whistleblower first informed Cisco in 2008 that a bug in its surveillance software could have enabled hackers to monitor video footage, delete footage and turn on or disable the systems. Government entities including the U.S. Secret Service, the Federal Emergency Management Agency and the New York Police Department had purchased the software, according to the Washington Post, which first reported the news. Cisco’s settlement appears to be the first whistleblower resolution of the False Claims Act, which prohibits defrauding the government, regarding cybersecurity issues. “The tech industry needs to fulfill its professional responsibility to protect the public from their products and services,” whistleblower James Glenn said in a statement. “There’s this culture that tends […]

The post Cisco will pay $8.6 million to settle claims it sold US flawed surveillance software appeared first on CyberScoop.

Continue reading Cisco will pay $8.6 million to settle claims it sold US flawed surveillance software→

Capital One announces massive data breach; lone suspect arrested in Seattle

Posted on by

Financial giant Capital One announced a large data breach Monday, with the company saying that one person accessed personal information of approximately 100 million people in the United States and 6 million in Canada who had applied for or are currently considered users of the company’s credit cards. Additionally, the FBI arrested a woman in Washington state who is suspected of hacking into the company to obtain that information. Paige A. Thompson was arrested Monday and appeared in federal court in Seattle. According to the complaint, Thompson allegedly took wide swaths of personal information from Capital One’s cloud storage instances on March 22 and March 23. The company stored the data taken by Thompson on Amazon Web Services. The company says this information included names, addresses, zip codes/postal codes, phone numbers, email addresses, dates of birth and self-reported income. The information ranged from 2005 to early 2019. Additionally, Capital One […]

The post Capital One announces massive data breach; lone suspect arrested in Seattle appeared first on CyberScoop.

Continue reading Capital One announces massive data breach; lone suspect arrested in Seattle→

Equifax Settlement, Android Video File Exploit, Encryption Backdoors

Posted on by

This is your Shared Security Weekly Blaze for July 29th 2019 with your host, Tom Eston. In this week’s episode: Details on the Equifax breach settlement, why your Android phone could be exploited by simply watching a video file, and encryption ba… Continue reading Equifax Settlement, Android Video File Exploit, Encryption Backdoors→

David and Goliath: Approaching the ‘deal’

Posted on by

Adam Zagaris Contributor Share on Twitter Adam Zagaris is an attorney, partner and founder at Moonshot Legal, specializing in commercial contracts. Adam helps startups close deals and move up and to the right. It is a simple question with a complex answer. How does a startup get from zero to execution when negotiating contracts with […] Continue reading David and Goliath: Approaching the ‘deal’→

Teenage hackers are offered a second chance under European experiment

Posted on by

European authorities are testing out the idea that not every cybercrime investigation has to end with a hacker in handcuffs. Police in the U.K. and the Netherlands have created a legal intervention campaign for first-time offenders accused of committing cybercrimes, officials explained Tuesday at the International Conference on Cybersecurity at Fordham University. The effort, called “Hack_Right,” is aimed at first-time offenders between 12 and 23 years old who may be skirting the law from behind their keyboard and not even realize it. The experiment, which began last year, already has involved interactions with more than 400 young people in the U.K., the officials said. “We do this … to get out and find them and get them into computing clubs before we have to investigate someone and lock them up,” said Gregory Francis, acting national prevent lead at the National Cyber Crime Unit of the National Crime Agency. “[Cybercrime] is not a law […]

The post Teenage hackers are offered a second chance under European experiment appeared first on CyberScoop.

Continue reading Teenage hackers are offered a second chance under European experiment→