Friday, 1 February 2019
ROBO DE DATOS AFECTA A USUARIOS DE TARJETAS DISCOVER
Aún se desconoce el número de usuarios potencialmente afectados
Especialistas en seguridad en redes del Instituto Internacional de Seguridad Cibernética reportan un incidente de seguridad en los sistemas de las tarjetas Discover, gracias al que usuarios maliciosos habrían accedido a una cantidad indefinida de detalles de identificación de los clientes, como números de cuenta, fechas de vencimiento, e incluso códigos de seguridad de las tarjetas.
Incluso cuando esta clase de incidentes de seguridad son comunes entre las instituciones financieras, esta es la segunda ocasión en menos de un año en que Discover Financial Services notifica un robo de datos relacionado con las tarjetas de sus clientes a las autoridades de California.
Las leyes de California establecen que las empresas que realicen negocios con los residentes de la ciudad deben notificar a la oficina del Procurador General en caso de un robo de datos o incidentes de ciberseguridad similares que pudiesen afectar la privacidad y la información de sus clientes. Además de notificar, las empresas deben enviar una muestra de la información comprometida a la oficina del Procurador cuando el incidente de seguridad afecte a 500 o más californianos, comentan especialistas en ciberseguridad.
El pasado 13 de agosto, el equipo de Discover Financial Services descubrió que un número no especificado (desconocido para el público hasta la fecha) de cuentas de tarjetas Discover podría haber sido parte de una violación de datos; no obstante, la empresa hace hincapié en que el incidente “no involucró a los sistemas de las tarjetas”.
Con base en los comentarios de Discover, especialistas en seguridad en redes creen que los atacantes habrían obtenido la información comprometiendo los servicios de terceros con acceso a los datos de pago de los clientes de Discover, o bien los datos podrían haber estado a la venta en algún foro de dark web gracias al uso de malware de robo de datos o a skimmers de tarjetas instalados en puntos de venta o cajeros automáticos.
Discover decidió no revelar el número de usuarios involucrados en este incidente, aunque sí se sabe que la empresa decidió emitir nuevas tarjetas para cada uno de los clientes potencialmente afectados.
Acorde a expertos en seguridad en redes, el informe sobre el incidente de Discover menciona que: “Será emitida una nueva tarjeta con nuevos códigos de seguridad y fechas de vencimiento para mitigar los riesgos de fraude de identidad o similares. Si encuentra indicios de actividades fraudulentas en su cuenta debe notificar a Discover para deslindar responsabilidades por actividad sospechosa.”
Discover llevó a cabo dos procesos de notificación de robo de datos en la oficina del Fiscal General, lo que hace suponer que en el incidente se vieron involucradas dos o más colecciones de datos de tarjetas de crédito, también puede significar que más de un tipo de tarjeta haya sido comprometido.
FACEBOOK SPYING ON TEENS USING A VPN
The social network is paying some users to install a VPN that allows them to monitor all the activity of a smartphone
Network security and ethical hacking specialists from the International Institute of Cyber Security claim that Facebook has been secretly paying some of its users to install a VPN, so the social network can fully monitor a user’s activity on his smartphone in a risky attempt to collect as much competitors’ information as possible.
When questioned, the social network recognized the use of a “research tool to collect user habits”.
According to the research, Facebook has been paying users between 13 and 35 years a figure that is around $20 per month in exchange for the installation of the application “Facebook Research” for about two years. The program is administered through beta testing services such as Applause, BetaBound and uTest to cover up Facebook’s participation.
The appearance of these reports shook Facebook, which announced that would close the iOS version of this tool. However, Apple released a statement last Tuesday announcing that Facebook violated some of its policies, so Apple decided to block this tool, contradicting the version that claimed that Facebook had decided to remove this application voluntarily.
Facebook Research requires users to grant extensive access to their data. Will Strafach, specialist in network security, analyzed the application and concluded that if Facebook completely uses the level of access granted by the user to this app, it can collect multiple sensitive data such as:
- Private conversations on different platforms (including multimedia files)
- Emails
- Internet searches and browsing history
- Location data
According to the specialist, Facebook gets almost unlimited access to the user’s device once Facebook Research is installed. This is a sample of how far Facebook is willing to go to secure its dominant position as a social networking and data collection platform.
Apple manager Tim Cook criticized Facebook’s data collection practices, considering that the social network breached iOS data policies by collecting more data than technology companies are allowed to.
Facebook began with this practice when it acquired Onavo in 2014. The VPN conducted analysis to minimize users’ mobile data plan usage, but also collected details about other applications that were used on a device. For example, thanks to Onavo, Facebook discovered that in one day more than double messages were sent through WhatsApp that through Facebook Messenger, vital information for the social network decided to buy the instant messaging app for over $19 billion USD in 2014. Since then, Onavo began compiling useful information for Facebook’s decision making, until its closure in 2018 by criticisms of online privacy advocates.
Project Atlas
According to network security specialists, Facebook has been paying some users to download Facebook Research tool, a similar VPN available in the mobile app stores, a research plan known as “Project Atlas.”
Program administrators seek to recruit young people between the ages of 13 and 17 (through Instagram, Snapchat, etc.) for a “paid social media research”. The program registration form mentions “although there are no risks associated with this project, the user recognizes that the nature of this program implies tracking their personal information through mobile app use”.
Facebook is especially interested in what teenagers do on their smartphones, as they are the users who have moved from this social network the most, mention experts in network security. However, Facebook’s intent has been criticized by online privacy advocates and cyber-security experts, especially at a time when the social network has been involved in so many scandals about privacy violations and misuse of personal data.
NEW NINTENDO SWITCH FIRMWARE WAS HACKED THE SAME DAY IT WAS RELEASED
Nintendo claimed to have added advanced security codes in this new version of the switch firmware
The latest version of the Nintendo Switch firmware was hacked the same day it was launched, reported network security and ethical hacking specialists from the International Institute of Cyber Security. Users managed to hack the anticipated 7.0.0 firmware version, implemented to improve the stability of the console, just 4 hours after its launching.
Nintendo claimed that this version of the Switch firmware included advanced security codes as a preventative measure against any hacking activity, although due to this incident, network security specialists consider the developers underestimated the capabilities of console users and videogame hackers.
Thanks to this Nintendo has become the target of the mocking of thousands users on various platforms of social networks, mainly in Reddit, because even the most enthusiastic have surprised the ease and efficiency with which the hackers achieved to bypass the “advanced” Switch firmware security measures.
The hacker in charge of compromising the firmware, known as ‘Elmirorac’, was supported by another hacker with the alias of ‘SciresM’, which is the same expert who discovered how to fully compromise a Switch console, also mentioning that this bug only could be solved with a hardware update.
Network security experts believe that Nintendo should reconsider the exclusive use of Nvidia Tegra processors in its consoles, installing a new set of chips before these drawbacks are incorrigible and the use of piracy completely seizes the market of the Switch consoles.
The bug, known as Tegra Bootrom, is a widely documented security problem. Experts consider that even Google should pay attention to the problems generated by the use of these chips, as these hardware pieces are also used in multiple Android devices.A
DATA BREACH AFFECTS DISCOVER CARD USERS
The number of potentially affected users is still unknown
Network security and ethical hacking specialists from the International Institute of Cyber Security reported a security incident on the Discover card systems, thanks to which malicious users would have accessed an indefinite amount of users’ personal details, such as account numbers, expiration dates, and even card security codes.
Even when this kind of security incidents are common among financial institutions, this is the second time in less than a year when Discover Financial Services notifies a data breach related to the cards of its clients to the California authorities.
California law states that companies conducting business with city residents must notify the Attorney General’s office in the event of a theft of similar data or cybersecurity incidents that may affect customers’ information and privacy. In addition to notifying, companies must send a sample of the compromised information to the Attorney’s office when the security incident affects 500 or more Californians, said experts in cybersecurity.
On August 13, the Discover Financial Services team found that an unspecified number (still not publicly disclosed) of Discover card accounts could have been part of a data breach; however, the company stresses that the incident “did not involve the card systems”.
Based on Discover’s comments, network security specialists believe that the attackers would have obtained the information by engaging third-party services with access to the Discover customer’s payment data, or the data could have been for sale in some dark web forums thanks to the use of data theft malware or to card skimmers installed in sale points or ATMs.
Discover decided not to disclose the number of users involved in this incident, although it is known that the company decided to issue new cards for each of the potentially affected customers.
According to experts in network security, the Discover incident report mentions that: “A new card will be issued with new security codes and expiration dates to mitigate the risks of identity fraud or similar malicious activities. If you find any evidence of fraudulent activity in your account, you must notify Discover to provide liability for suspicious activities”.
Discover conducted two data breach notification processes in the attorney General’s office, implying that in the incident two or more collections of credit card data were involved, it may also mean that more than one type of card has been compromised.
