Geek-Guy.com

Category: privacy

Facebook Flaws and Privacy Laws: A Journey into Early Social Media Security from 2009

Join hosts Tom Eston, Scott Wright, and Kevin Johnson in a special best-of episode of the Shared Security Podcast. Travel back to 2009 with the second-ever episode featuring discussions on early Facebook bugs, cross-site scripting vulnerabilities, and a pivotal Canadian privacy ruling involving Facebook. Gain insights into social media security from the past and see…

Google will pay Texas $1.4 billion to settle privacy lawsuits

Google has agreed to pay the state of Texas $1.375 billion to settle two lawsuits accusing the company of tracking users’ personal location, incognito searches, and voice and facial data without their permission. The lawsuits were brought by Texas Attorney General Ken Paxton in 2022. Facebook’s parent company Meta agreed to pay a similar amount…

Microsoft Listens to Security Concerns and Delays New OneDrive Sync

  Misuse of the newly announced Microsoft OneDrive synchronization feature puts corporate security and personal privacy at serious risk in ways not likely understood by the users. Microsoft wants people to connect their personal OneDrive file share with their work systems, synchronizing potentially private files onto their enterprise managed PCs. The problem is having these…

A timeline of South Korean telco giant SKT’s data breach

In April, South Korea’s telco giant SK Telecom (SKT) was hit by a cyberattack that led to the theft of personal data on approximately 23 million customers, equivalent to almost half of the country’s 52 million residents. At a National Assembly hearing in Seoul on Thursday, SKT chief executive Young-sang Ryu said about 250,000 users…

NSO Group owes $168M in damages to WhatsApp over spyware infections, jury says

A federal jury decided Tuesday that NSO Group must pay WhatsApp approximately $168 million in damages after a judge ruled that it violated anti-hacking laws when 1,400 of the messaging application’s users became infected with Pegasus spyware. It’s the latest in a series of wins in court for WhatsApp in its pioneering lawsuit that has produced…

Privacy for Agentic AI

Sooner or later, it’s going to happen. AI systems will start acting as agents, doing things on our behalf with some degree of autonomy. I think it’s worth thinking about the security of that now, while its still a nascent idea. In 2019, I joined Inrupt, a company that is commercializing Tim Berners-Lee’s open protocol…

Judge limits evidence about NSO Group customers, victims in damages trial

A federal judge last week placed strict limits on the kind of evidence NSO Group can raise during a trial on damages in the lawsuit WhatsApp brought against the spyware vendor over allegations it hacked 1,400 of the messaging platform’s users. Under the order, NSO Group is prohibited from presenting evidence about its customers’ identities,…

The latest viral ChatGPT trend is doing ‘reverse location search’ from photos

There’s a somewhat concerning new trend going viral: people are using ChatGPT to figure out the location shown in pictures. This week, OpenAI released its newest AI models, o3 and o4-mini, both of which can uniquely “reason” through uploaded images. In practice, the models can crop, rotate and zoom in on photos — even blurry…

35 countries use Chinese networks for transporting mobile user traffic, posing cyber risks

U.S. allies are among the 35 countries where mobile providers employ China-based networks for transporting user traffic, opening travelers and residents in those nations to potential surveillance, an analysis published Thursday concludes. “Everyone knows that they have to be careful with their phones when they travel to China,” Rocky Cole, chief operating officer at iVerify,…

Exclusive: Peters, Rounds tee up bill to renew expiring cyber threat information sharing law

A bipartisan pair of senators are kicking off the race Wednesday to reauthorize a 2015 cyber threat information sharing law, a move that industry groups and cyber experts are eager to see happen before it’s set to expire in September. Advocates say the 10-year-old Cybersecurity Information Sharing Act has been vital to sharing threat information…

Judges strike skeptical note of NSO Group’s argument to dismiss case from El Salvadoran journos

A panel of U.S. judges considering an appeal of a ruling that went against El Salvadoran journalists suing NSO Group over alleged infections of their phone by the company’s Pegasus spyware appeared more skeptical Thursday of the vendor’s arguments than those of the reporters. Judge James Donato of the District Court for the Northern District…

Cyber experts offer lukewarm praise for voluntary code governing use of commercial hacking tools

Cybersecurity professionals who participated in discussions over a code of conduct for nations to use commercial hacking tools said the final voluntary guidelines offer modest promise, even if they fall short of what some wanted. The next step for the joint France/U.K.-led Pall Mall Process, which last week got 21 signatories to the code, is…

Smashing Security podcast #412: Signalgate sucks, and the quandary of quishing

QR codes are being weaponised by scammers — so maybe think twice before scanning that parking meter. And in a blunder so dumb it makes autocorrect look smart, the White House explains how it leaked war plans on Signal because an iPhone mistook a journalist for a government insider. Plus! Don’t miss our featured interview…

Privacy fights over expiring surveillance law loom after House hearing

Lawmakers on the House Judiciary Committee say privacy protections under a bill Congress passed to re-up a major surveillance law aren’t strong enough, and are gearing up for additional changes for when the legislation is set to expire next year. Legislative battles over Section 702 of the Foreign Intelligence Surveillance Act (FISA) — under which…

Waymo may use interior camera data to train generative AI models, but riders will be able to opt out

Waymo is preparing to use data from its robotaxis, including video from interior cameras tied to rider identities, to train generative AI models, according to an unreleased version of its privacy policy found by researcher Jane Manchun Wong, raising fresh questions about how much of a rider’s behavior inside autonomous vehicles could be repurposed for…

Voluntary ‘Pall Mall Process’ seeks to curb spyware abuses

Twenty-one nations signed on to a voluntary accord last week in Paris to govern the use of commercial hacking tools commonly known as spyware, after more than a year of work on the agreement. The Pall Mall Process, or Code of Practices for States, has four pillars for the responsible use of the surveillance tech,…

Waymo may use interior camera data to train generative AI models, sell ads

Waymo is preparing to use data from its robotaxis, including video from interior cameras tied to rider identities, to train generative AI models, according to an unreleased version of its privacy policy found by researcher Jane Manchun Wong.  The draft language reveals Waymo may also share this data to personalize ads, raising fresh questions about…

The 23andMe Collapse, Signal Gate Fallout

In this episode, we discuss the urgent need to delete your DNA data from 23andMe amid concerns about the company’s potential collapse and lack of federal protections for your personal information. Kevin joins the show to give his thoughts on the Signal Gate scandal involving top government officials, emphasizing the potential risks and lack of…

Ente wants to take on Google Photos with its privacy-first photo storage service

Despite Google’s intentions for its default image viewing and editing app for Android, the Photos app has, over the years, become one of the most popular photo backup services around. In fact, it was one of the most attractive offerings for years until it stopped offering unlimited storage in 2020. That change in the tech…

Understanding Privacy Changes: eBay’s AI Policy and The Future of Data Privacy

In this episode, host Tom Eston discusses recent privacy changes on eBay related to AI training and the implications for user data. He highlights the hidden opt-out feature for AI data usage and questions the transparency of such policies, especially in regions without strict privacy laws like the United States. The host also explores how…

Senators criticize Trump officials’ discussion of war plans over Signal, but administration answers don’t come easily 

Democratic senators hammered two top national security officials Tuesday about their participation in a Signal chat discussing war plans that reportedly included a journalist, but struggled to get specific answers to some of their questions about what happened and how. Director of National Intelligence Tulsi Gabbard wouldn’t even initially acknowledge her involvement in the chat group,…

Privacy-boosting tech could prevent breaches, data misuse with government aid, report says

Governments should prioritize the use of privacy-boosting technologies like encryption, de-identification and hashing to prevent breaches and data misuse, a report that New America’s Open Technology Institute published Tuesday recommends. The study comes as cyber and privacy experts warn about the dangers of the Trump administration’s Department of Government Efficiency (DOGE) accessing sensitive information at…

As 23andMe declares bankruptcy, privacy advocates sound alarm about DNA data

Genetic testing business 23andMe filed for bankruptcy Sunday, amplifying fears from privacy advocates that the DNA records and personal information of its 15 million customers could soon be up for sale to the highest bidder. 23andMe, which was once valued at $6 billion, has been experiencing financial distress and declining profits since going public in…

From Spreadsheets to Solutions: How PlexTrac Enhances Security Workflows

In this special episode of the Shared Security Podcast, join Tom Eston and Dan DeCloss, CTO and founder of PlexTrac, as they discuss the challenges of data overload in vulnerability remediation. Discover how PlexTrac addresses these issues by integrating various data sources, providing customized risk scoring, and enhancing remediation workflows. The episode offers an insightful…

Meta settles UK ‘right to object to ad-tracking’ lawsuit by agreeing not to track plaintiff

A human rights campaigner, Tanya O’Carroll, has succeeded in forcing social media giant Meta not to use her data for targeted advertising. The agreement is contained in a settlement to an individual challenge she lodged against Meta’s tracking and profiling back in 2022. O’Carroll had argued that a legal right to object to the use…

Smashing Security podcast #409: Peeping perverts and FBI phone calls

In episode 409 of the “Smashing Security” podcast, we uncover the curious case of the Chinese cyber-attack on Littleton’s Electric Light Company, and a California landlord’s hidden camera scandal. Find out about this, and more, in the latest edition of the “Smashing Security” podcast by cybersecurity veterans Graham Cluley and Carole Theriault.

ChatGPT hit with privacy complaint over defamatory hallucinations

OpenAI is facing another privacy complaint in Europe over its viral AI chatbot’s tendency to hallucinate false information — and this one might prove tricky for regulators to ignore. Privacy rights advocacy group Noyb is supporting an individual in Norway who was horrified to find ChatGPT returning made-up information that claimed he’d been convicted for…

Six additional countries identified as suspected Paragon spyware customers

Researchers have identified suspected government customers of spyware company Paragon Solutions in six more countries that hadn’t previously been publicly identified, according to a report published Wednesday. The University of Toronto’s Citizen Lab said it mapped the infrastructure of Paragon’s Graphite tool after a tip from a collaborator, and found a subset of suspected Paragon…

EU sends Apple first DMA interoperability instructions for apps and connected devices

The European Union has sent Apple preliminary instructions on how it expects the iPhone maker to comply with interoperability provisions in the bloc’s Digital Markets Act (DMA), its flagship market contestability reform. According to the Commission, device manufacturers and app developers should be able to access nine iOS connectivity features that were restricted to Apple’s…

Cape opens $99/month beta of its privacy-first mobile plan, inks Proton deal, raises $30M

Mobile networks continue to be a major target for cybersecurity breaches, and Chinese hacking group Salt Typhoon‘s persistent attacks on multiple carriers are only the latest known examples.  The mobile carrier startup Cape is taking a novel approach to addressing the problem: it has built a service it says can provide a more secure, private…

DOGE staffer violated security policies at Treasury Department, court filing shows

A staffer for the Department of Government Efficiency (DOGE) violated security policies at the Treasury Department by improperly sharing sensitive personal information outside the agency, according to a court filing. The filing last week came in a case state attorneys general brought against President Donald Trump and Treasury Secretary Scott Bessent challenging DOGE access to…

Tackling Data Overload: Strategies for Effective Vulnerability Remediation

In part one of our three part series with PlexTrac, we address the challenges of data overload in vulnerability remediation. Tom hosts Dahvid Schloss, co-founder and course creator at Emulated Criminals, and Dan DeCloss, CTO and founder of PlexTrac. They share their expertise on the key data and workflow hurdles that security teams face today.…

Apple Fights UK Over Encryption Backdoors as US Officials Warn of Privacy Violations

The British side reportedly said they would have to produce warrants for each individual data access request, so they will always have to be made as part of an investigation into serious crime.

California’s legal push on geolocation data collection must take aim at the right targets, privacy experts say

The attorney general for California announced this week a wide-ranging investigation into the way companies collect, process and use consumer location data. The investigation will include scrutiny of advertising networks, mobile app providers and data brokers whose practices may violate the California Consumer Privacy Act (CCPA), one of the strictest state privacy laws in the…

iPhone and Android users will soon be able to send encrypted RCS messages to each other

Text messages sent between iPhones and Android devices will soon benefit from end-to-end encryption (E2EE), after the GSM Association (GSMA) yesterday published new specifications for the Rich Communication Services (RCS) protocol that include support for cross-platform E2EE. RCS is a long-standing effort to enable SMS-style cross-platform communications with richer features, such as group messaging, typing…

UK’s secret iCloud backdoor order triggers civil rights challenge

The U.K. government’s secret order to Apple demanding it backdoor the end-to-end encrypted version of its iCloud storage service has now been challenged by two civil rights groups, Liberty and Privacy International, which filed complaints Thursday. They called the order “unacceptable and disproportionate” and warned of “global consequences” as the access order is thought to…

Trade groups worry information sharing will worsen without critical infrastructure panel, CISA law renewal

Business groups told lawmakers Tuesday that they fear cyber threat information sharing could drop off in light of the Trump administration’s move to eliminate a critical infrastructure committee and given the pending expiration of a 2015 law. The Critical Infrastructure Partnership Advisory Council (CIPAC) fell among a swath of government advisory committees that Homeland Security…

New York sues Allstate and subsidiaries for back-to-back data breaches

Allstate and several of the insurance company’s subsidiaries were accused of poor security practices resulting in data breaches in 2020 and 2021 that exposed sensitive data on nearly 200,000 people, the New York State Attorney General office said in a lawsuit filed Monday.  National General, an insurance company Allstate acquired for $4 billion in 2021,…

Trump Administration and the Russian Cyber Threat, Firefox Privacy Changes

In this episode, we discuss whether the Trump administration ordered the U.S. Cyber Command and CISA to stand down on the Russian cyber threat. We also touch on the Canadian tariff situation with insights from Scott Wright. Additionally, we discuss the recent changes to Firefox’s privacy policy and what it means for user data. **…

DuckDuckGo leans further into GenAI as its AI chat interface exits beta

Private search engine DuckDuckGo is leaning further into the generative AI opportunity. The non-tracking search engine has been dabbling with expanding the role of AI assistance in its product for the past year, including launching a chatbot-style interface last fall — available at Duck.ai. In a blog post Thursday, the company said the service is…

Apple is challenging U.K.’s iCloud encryption backdoor order

Apple is challenging a U.K. Government data access order in the Investigatory Powers Tribunal (IPT), the Financial Times reports. The order targeted iCloud backups that are protected by end-to-end encryption. Last month, press leaks revealed the existence of the January order asking Apple to build a backdoor in iCloud’s encrypted backups. U.K. officials are exercising…

UK probes how TikTok, Reddit, and Imgur protect child privacy

The U.K.’s privacy watchdog has launched investigations into three social media companies over how they go about protecting the privacy of children on their respective platforms. The Information Commissioner’s Office (ICO) announced today that it’s looking into how TikTok uses personal information of 13- to 17-year-olds to recommend videos, “in light of growing concerns” around…

Jolla founders take the wraps off an AI assistant to power up their push for privacy-friendly GenAI

Jolla, the erstwhile mobile maker turned privacy-centric AI business — via sister startup, Venho.ai — has taken the wraps off an AI assistant it says is a “fully private” alternative to data-mining cloud giants crawling all over your personal information.   The AI assistant is designed to integrate with apps like email, calendar and social…

Cybersecurity Impact of DOGE, Apple’s Stand Against Encryption Backdoors

In this episode, Kevin and Tom discuss current events including the latest developments with DOGE and the significant changes happening at the Cybersecurity and Infrastructure Security Agency (CISA). They also touch on Apple’s decision to refuse creating backdoors for encryption, setting a new precedent in digital security. Tune in for an insightful discussion on the…

Cybersecurity Impact of DOGE, Apple’s Stand Against Encryption Backdoors

In this episode, Kevin and Tom discuss current events including the latest developments with DOGE and the significant changes happening at the Cybersecurity and Infrastructure Security Agency (CISA). They also touch on Apple’s decision to refuse creating backdoors for encryption, setting a new precedent in digital security. Tune in for an insightful discussion on the…

Signal is the number-one downloaded app in the Netherlands. But why?

Privacy-focused messaging app Signal has been flying high in the Dutch app stores this past month, sitting many days as the most downloaded free app on iOS and Android for all categories, per data from multiple app-tracking platforms such as Sensor Tower. The app has experienced surges in popularity through the years, often in response…

Mozilla responds to backlash over new terms, saying it’s not using people’s data for AI

Mozilla has responded to user backlash over the Firefox web browser’s new Terms of Use, which critics have called out for using overly broad language that appears to give the browser maker the rights to whatever data you input or upload. The company says the new terms aren’t a change in how Mozilla uses data,…

Apple introduces new child safety initiatives, including an age verification system for apps

Apple on Thursday announced a range of new initiatives designed to help parents and developers create a safer experience for kids and teens using Apple devices. In addition to easier setup of child accounts, parents will now be able to share information about their kids’ ages, which can then be accessed by app developers to…

Google makes it easier to delete personal info from Search results

Google announced on Wednesday that it’s updating its “Results about you” tool to make it easier for users to protect and remove their personal information from Search results. The company says it’s improved the sign-up process and simplified requesting removals directly from Google Search. The tool can be used to proactively monitor and delete things…

A major cybersecurity law is expiring soon — and advocates are prepping to push Congress for renewal 

A push is gearing up to renew an expiring 10-year-old cybersecurity law that was viewed at its initial passage as the most significant cybersecurity legislation Congress had ever passed, and that advocates say now fosters several important threat-sharing initiatives. The 2015 Cybersecurity Information Sharing Act provides safeguards for companies that voluntarily share threat intelligence data…

Murena now sells a ‘deGoogled’ Pixel Tablet

Murena, the French privacy firm that’s forked Android to deliver so-called deGoogled smartphones, has repeated the trick with a tablet. So if you’re keen to get your hands on a shiny Pixel Tablet — but without the usual bundle of Google apps and services — Murena has you covered. The Murena Pixel Tablet runs the…

X is blocking links to Signal, a secure messaging platform used by federal workers

Elon Musk’s X (formerly Twitter) is blocking links to Signal.me, a URL shortener used by the private messaging app Signal that allows users to send out a link that’s used to contact them directly through the service. The blocks, which impact direct messages, public posts, and profile pages, were first spotted by the blog Disruptionist. …

South Korea blocks downloads of DeepSeek from local app stores

South Korean officials on Saturday temporarily restricted Chinese AI Lab DeepSeek’s app from being downloaded from app stores in the country pending an assessment of how the Chinese company handles user data. The Personal Information Protection Commission (PIPC) said the Chinese app would be available to be downloaded once it complies with Korean privacy laws…

UK’s Secret Apple Backdoor Request, AI Chatbots Used For Stalking

In this episode, we discuss the UK government’s demand for Apple to create a secret backdoor for accessing encrypted iCloud backups under the Investigatory Powers Act and its potential global implications on privacy. We also discuss the first known case where AI chatbots were used in a stalking indictment, highlighting the dangers of technology misuse…

What is an encryption backdoor?

Talk of backdoors in encrypted services is once again doing the rounds after reports emerged that the U.K. government is seeking to force Apple to open up iCloud’s end-to-end encrypted (E2EE) device backup offering. Officials were said to be leaning on Apple to create a “backdoor” in the service that would allow state actors to…

These Google Photos alternatives offer tons of storage options at a reasonable price

Google Photos is a great service for storing images across devices. But Google Drive and Gmail only offer 15GB of storage for free. Google Photos used to offer free unlimited storage of images, but that is not the case anymore. If you are looking for a better photo storage plan, different features, or just want…

EU abandons ePrivacy, AI liability reforms, as bloc shifts focus to competitiveness & data access for AI

A long stalled bid to beef up European Union rules around online tracking technologies — and put penalties on a similar footing to the bloc’s data protection framework, GDPR, which allows for fines of up to 4% of annual turnover for breaches — has been withdrawn by the Commission after co-legislators failed to reach agreement…

Careers in Cybersecurity: Myths and Realities with Kathleen Smith

In this episode we welcome Kathleen Smith, CMO of ClearedJobs.net, to discuss the current state of the cybersecurity job market. Kathleen shares her extensive experience in the field, recounting her tenure in various cybersecurity events and her contributions to job market research and recruiting. She discusses challenges such as distinguishing between genuine workforce shortages and…

OpenAI launches data residency in Europe

OpenAI on Thursday launched data residency in Europe, allowing European organizations to meet local data sovereignty requirements while using the AI company’s products. Data residency refers to the physical location of an organization’s data, as well as the local laws and policy requirements imposed on that data. Most tech giants and cloud providers offer European…

Lawmakers fear Elon Musk, DOGE not adhering to privacy rules

Congress is getting vocal about the privacy and security implications of Elon Musk and his cohorts at the Department of Government Efficiency accessing federal systems. Democrats on the House Homeland Security Committee said Wednesday DOGE must comply with security and privacy laws as they obtain access to federal systems, something the lawmakers say they don’t…

Privacy Concerns with Digital Driver’s Licenses, The Rise of DeepSeek AI

In this episode, we explore the rollout of digital driver’s licenses in states like Illinois and the potential privacy issues that come with them. Can digital IDs truly enhance convenience without compromising your privacy? We also discuss the new Chinese AI model, DeepSeek, which is affecting U.S. tech companies’ stock prices. Join us as we…

WhatsApp says it disrupted spyware campaign aimed at reporters, civil society

WhatsApp said Friday that it had disrupted a spyware campaign that targeted 90 people, including journalists and activists. The company tied to the campaign, according to WhatsApp, is Israeli firm Paragon, which last fall signed a $2 million contract with Immigration and Customs Enforcement and recently was purchased by U.S. private equity giant AE International.…

Tulsi Gabbard tussles with senators over Snowden, surveillance 

Tulsi Gabbard, President Donald Trump’s nominee for director of national intelligence, told the Senate Intelligence Committee on Thursday that she would leave her own political views “at the door” and deliver “intelligence that is collected, analyzed and reported without bias, prejudice or political influence.” But she also accused the Biden administration and other national security…

Smashing Security podcast #402: Hackers get hacked, the British Museum IT shutdown, and social media kidnaps

What happens when eager computer enthusiasts unknowingly download a trojanized hacking tool and find themselves on the wrong side of cybersecurity? A former employee’s actions led to chaos and raise urgent questions about the security of cultural treasures. And join us as we explore the alarming trend of social media influencers staging fake kidnappings. All…

Ireland and Italy send data watchdog requests to DeepSeek: ‘The data of millions of Italians is at risk’

The jury is still out on whether the Chinese AI upstart DeepSeek is a game changer or part of an elaborate plan by its hedge fund parent company to short Nvidia and other tech stocks. Whichever it might be (maybe both?), DeepSeek and its large language model have made some major waves. And now, it’s…