
<amp-img src="/blog-content/september-2022/091622/european-union.jpg" layout="responsive" width="2000" height="1333" alt="european-union">
</amp-img>
<img src="/blog-content/september-2022/091622/european-union.jpg" layout="responsive" width="2000" height="1333" alt="european-union">
</img>

Facebook-owned Instagram is facing a huge privacy fine from the European Union. This time, it’s a massive €405 for breaching the General Data Protection Regulation (GDPR).

The fine was issued by the Irish Data Protection Commission (DPC) after Instagram was found wanting for how it processed children’s data.

This is the second largest GDPR fine ever issued after the €746 million levied on Amazon in 2021.

## Instagram data failings

Instagram apparently set all contact details for new users to "publicly available" when creating new accounts. The user would actively have to set this to private to protect it.

This contravenes the GDPR, which is all about protecting user data within the European Union.

Instagram says it has made changes since the finding to correct the issue and improve privacy settings.

“This inquiry focused on old settings that we updated over a year ago, and we’ve since released many new features to help keep teens safe and their information private," an Instagram spokesperson said.

"Anyone under 18 automatically has their account set to private when they join Instagram, so only people they know can see what they post, and adults can’t message teens who don’t follow them."

"We engaged fully with the DPC throughout their inquiry, and we’re carefully reviewing their final decision."

## Meta does it again

This huge fine for data handling comes after WhatsApp was also fined €235 million for its lack of transparency with how data was shared with Facebook.

Facebook was also directly fined €17 million earlier this year for GDPR data breaches, 12 of them in fact.

This is turning out to be a very expensive year for the company. Let’s hope this is the last fine and last instance of mishandling our data we have to report!


Instagram Faces 405 Million Euro Fine


<amp-img src="/blog-content/september-2022/091522/tiktok-data-leak.jpg" layout="responsive" width="2000" height="1333" alt="tiktok-data-leak">
</amp-img>
<img src="/blog-content/september-2022/091522/tiktok-data-leak.jpg" layout="responsive" width="2000" height="1333" alt="tiktok-data-leak">
</img>

The giant that is TikTok has never been far from controversy, but this latest news could be the biggest yet. It is alleged that TikTok has been hit with a massive data breach that could impact _all_ of its 2 billion users.

It’s important to note that TikTok denies this outright, but they would, wouldn’t they?

“We have confirmed that the data samples in question are all publicly accessible and are not due to any compromise of TikTok systems, networks, or databases,” said the firm, in a statement.

“We do not believe users need to take any proactive actions, and we remain committed to the safety and security of our global community.”

The breach is said to include database information, source code for the platform, and user records. Around 790GB of data has been made available all in all.

## Breach, or a Shocking Status Quo

There is still some suspicion around whether the leak as due to a breach or not, but we know with certainty that at least some of the data is already publicly available.

The 790GB of data includes 2.05 billion records. Some researchers say it’s all publicly available information if you know where to look.

"This is so far pretty inconclusive; some data matches production info, albeit publicly accessible info," security researcher Troy Hunt said in a tweet. "Some data is junk, but it could be non-production or test data. It's a bit of a mixed bag so far."

The data was initially made available on the Breach Forums earlier this month, and was apparently taken from TikTok’s Alibaba cloud storage account.

Owned and operated by Chinese company ByteDance, TikTok has remained in the headlines ever since it began becoming popular in the west. As its owned by a Chinese company and subject to scrutiny from the Chinese state, the network has always been viewed with suspicion.

President Trump tried to ban TikTok in the US but failed. It did result in ByteDance moving data related to US TikTok users to servers operated by Oracle within the States.

Whatever the truth of the situation, it’s just one more example of the dangerous amounts of data collected by social networks.

While there is no need to take any action here, being aware of just what you share, when, and where is something we all need to do.


TikTok Denies Data Breach Allegedly Affecting 2 Billion Users


<amp-img src="/blog-content/september-2022/091422/woman-swiping-card.jpg" layout="responsive" width="2000" height="1333" alt="woman-swiping-card">
</amp-img>
<img src="/blog-content/september-2022/091422/woman-swiping-card.jpg" layout="responsive" width="2000" height="1333" alt="woman-swiping-card">
</img>

Recently, a Costco location [had to warn its customers](https://www.cpomagazine.com/cyber-security/credit-card-skimmer-at-costco-compromises-customers-payment-information/) that their credit card information may have been compromised due to an undetected skimmer being planted on one of the terminals. This kind of news is very scary, but how common is it really?

## What are credit card skimmers?

Credit Card skimmers work in exactly the same was as Credit Card scanners. Essentially, when you either swipe your card or use the chip, the payment information is transferred to a terminal, and then money is extracted from it automatically. Trustworthy entities only take as much money as is necessary; however, technically, if you have all of somebody’s information, you can extract as much money as you want from them.

This is how Credit Card skimmers work. They scan your card’s payment information like normal, but then transfer it to the bad actor. Those actors will then use extract as much money as they want from you.

## How common are they?

Thankfully, these attacks are relatively rare. [According to Kaspersky](https://www.pcmag.com/how-to/how-to-spot-and-avoid-credit-card-skimmers), a Russian cybersecurity company, peak attacks a month are below 2,000 in the entire United States. Considering how many purchases are made, this is an extremely small number.

## Protecting yourself from credit card skimmers

Credit card skimmers are most often found on ATM machines and are relatively easy to spot. If the card reader seems bigger than usual, or is loose to the touch, then you should report it to the authorities as soon as possible - and should absolutely not put your card in it. This principle also applies to gas stations as well as self checkout grocery stores.

## Takeaways

All in all, while this isn’t a significant threat, it should be taken seriously, and knowing the signs can save you both the money that gets stolen in addition to any hits in credit and inconvenience with getting a new card.

Be sure to shimmy those card readers!


Are Credit Card Skimmers Worth Worrying About?


<amp-img src="/blog-content/september-2022/091322/camera-youtuber.jpg" layout="responsive" width="2000" height="1333" alt="camera-youtuber">
</amp-img>
<img src="/blog-content/september-2022/091322/camera-youtuber.jpg" layout="responsive" width="2000" height="1333" alt="camera-youtuber">
</img>

Anyone who creates content online will know the fear of DMCA notices well. That’s especially true if you use YouTube.

Digital Millennium Copyright Act notices are copyright warnings requesting takedowns of protected content. Many are sent for legitimate reasons, but many are not. Some are polite and request the removal of copyrighted content, but others are more threatening.

It seems scammers are taking advantage of that in a new campaign.

DMCA emails are being sent that look and feel just like legitimate notices. They include a link to a ‘YouTube Copyright Report’ and a .zip attachment.

That attachment includes malware that tries to identify the device, the IP address, whether antivirus is running, and contact a home server in Finland.

It has been linked with RedLine Stealer malware that harvests personal data for later use. It’s a common form of malware freely available on the dark web for as little as $100.

It seems now scammers are playing on fear in order to trick people into infecting themselves.

## Using Fear to Infect

For the majority of YouTube creators, being hit with a DMCA is a scary time, even if it’s all part of doing business online. Some notifications can be from big law firms and use strong language to try to illicit the desired action.

Scammers are using the same tactic to try to illicit an infection action.

By dressing it up within a DMCA notice, the malware is taking advantage of people in a scared state. People in this state don’t always make the best decisions or use the normal decision-making processes they usually would. That’s what the people behind this campaign is taking advantage of.

So, if you publish on YouTube and receive DMCA notices, double check to make sure it’s legit!


Phony YouTube DMCA Notice Installing Malware


<amp-img src="/blog-content/september-2022/091222/space-image.jpg" layout="responsive" width="2000" height="1450" alt="space-image">
</amp-img>
<img src="/blog-content/september-2022/091222/space-image.jpg" layout="responsive" width="2000" height="1450" alt="space-image">
</img>

Have you been marveling at the images of the stars sent back by the James Webb Space Telescope? Have you been sent images via email and opened them? If so, you may have been infected by malware.

A malware campaign is underway as part of GO#WEBBFUSCATOR that uses the Go language to plant malware on unsuspecting users.

It uses infected emails with a VBA macro to infect users and has been around for a while. The newest variant has been spotted within images from the James Webb Space Telescope.

## Infected emails

The malware campaign has been seen a few times in different guises. This latest version was discovered by researchers from Securonix.

"The deobfuscated [macro] code executes [a command] which will download a file named OxB36F8GEEC634.jpg, use certutil.exe to decode it into a binary (msdllupdate.exe) and then finally, execute it," Securonix researchers said.

The binary, a Windows 64-bit executable with a size of 1.7MB is not only equipped to fly under the radar of antimalware engines, but is also hidden by means of a technique called gobfuscation, which makes use of a Golang obfuscation tool publicly available on GitHub. Microsoft has blocked macros in Office apps but this doesn’t seem to be stopping the attack.

It will be causing modifications using LNKL and ISO files, but the attacks being seen right now still use VBA macros. If you use Office 365 or keep your version of Office updated, it should protect you from the macro and refuse to run it.

If you’re using an older version of Office, you may still be susceptible to it.

These new Go malware variants are tough to spot and tougher to reverse engineer so we expect to see a lot more of them.

In the meantime, practice good email hygiene and delete what you don’t know and you should be fine!


Malware Could be Hiding in Images from James Webb Space Telescope


<amp-img src="/blog-content/september-2022/091022/laptop.jpg" layout="responsive" width="6016" height="4000" alt="laptop">
</amp-img>
<img src="/blog-content/september-2022/091022/laptop.jpg" layout="responsive" width="6016" height="4000" alt="laptop">
</img>

We honestly don’t have anything against Chrome. In fact, we use it all the time. We talk about it so much because there’s a constant stream of stories that we think you need to know about. It’s the same today.

The good news is, these are fake extensions and no ‘official’ Chrome ones. But they were available in the Chrome Web Store.

They have since been removed, but if you installed any of the extensions below, you might want to remove them.

5 different extensions for Netflix and a couple of others have been found to contain code that can track browsing activity and include affiliate programming.

"The extensions offer various functions such as enabling users to watch Netflix shows together, website coupons, and taking screenshots of a website," McAfee researchers Oliver Devane and Vallabh Chole said. "The latter borrows several phrases from another popular extension called GoFullPage."

The following 5 extensions are the ones to avoid:

1. Netflix Party (mmnbenehknklpbendgmgngeaignppnbe)
2. Netflix Party (flijfnhifgdcbhglkneplegafminjnhn)
3. FlipShope – Price Tracker Extension (adikhbfjdbjkhelbdnffogkobkekkkej)
4. Full Page Screenshot Capture – Screenshotting (pojgkmkfincpdkdgjepkmdekcahmckjp)
5. AutoBuy Flash Sales (gbnahglfafmhaehbdmjedfhdmimjcbed)

Each extension loads JavaScript to track where users go and inject affiliate links into relevant purchases to make money.

"Every website visited is sent to servers owned by the extension creator," the researchers noted. "They do this so that they can insert code into eCommerce websites being visited. This action modifies the cookies on the site so that the extension authors receive affiliate payment for any items purchased."

Interestingly, the code has the ability to delay activity for 15 days after installation in an attempt to obfuscate what’s going on.

The extensions have been removed from the web store and should no longer be available from official sources.

However, they are likely still available at unofficial app repositories and on those 1.4 million devices.

If you ever used one of these extensions, now is a good time to delete is and perform a full malware scan!


Chrome Extensions Used by 1.4 Million People Contain Malicious Cookies


<amp-img src="/blog-content/september-2022/090922/new-iphone.jpg" layout="responsive" width="2000" height="1300" alt="new-iphone">
</amp-img>
<img src="/blog-content/september-2022/090922/new-iphone.jpg" layout="responsive" width="2000" height="1300" alt="new-iphone">
</img>

A group of researchers have found that over 1,800 apps are leaking AWS and Amazon S3 data. The data could enable someone to access shared storage, SDKs, and other developer resources.

The apps contain tokens that enable access to private AWS services run by developers. Those services include file backups, resources, and other data that support the apps.

The Simple Storage Services (S3) buckets accessible from apps also contain data, backups and files.

"Over three-quarters (77%) of the apps contained valid AWS access tokens allowing access to private AWS cloud services," said Symantec's Threat Hunter team.

"The AWS access tokens could be traced to a shared library, third-party SDK, or other shared component used in developing the apps.”

One app provided by a B2B communications platform included an SDK that enabled the researcher to access its cloud infrastructure. This, in turn, allowed free access to all customer data, including financial records of over 15,000 organizations.

"Instead of limiting the hard-coded access token for use with the translation cloud service, anyone with the token had full unfettered access to all the B2B company's AWS cloud services," the researchers noted.

If that wasn’t enough, the researchers also tested 5 iOS banking apps and found they all used the same AI Digital Identity SDK. This enabled access to the biometric login data of over 300,000 users!

The Symantec Threat Hunter has alerted the developers and organizations responsible and hopefully we’ll see fixes soon.

This is a big blow to the app environment as it shows that the apps we use every day could potentially be leaving us and our data exposed.

Perhaps now might be a good time to inventory what apps we use and perform a little housekeeping!


More than 1,800 Android and iOS Apps Leaking AWS Data


<amp-img src="/blog-content/september-2022/090722/lock-and-key.jpg" layout="responsive" width="2000" height="1333" alt="lock-and-key">
</amp-img>
<img src="/blog-content/september-2022/090722/lock-and-key.jpg" layout="responsive" width="2000" height="1333" alt="lock-and-key">
</img>

Despite crime being at an [all-time low](https://www.disastercenter.com/crime/uscrime.htm), the home security industry is at its largest ever size. According to [some](https://www.securitysystemsnews.com/article/parks-associates-predicts-about-27-percent-us-households-have-security-2021), the home security market is growing, albeit slowly, to millions of customers in the United States alone. That being said, even though crime is low, are these systems worth the cost? How effective are they even in the best of circumstances?

## What are Home Security Systems?

The basic blueprint for these products is a camera and an alarm system. A security camera is installed by the biggest “weak points” around your property, and then those are attached to software that looks for things like movement to alert you about somebody or something entering your property. Usually, there’s a keypad or a passcode you can enter to disable this system so that you don’t get flagged by your own alarms.

However, depending on how much money you’re willing to spend, the expansions can get even more extreme. You can install door sensors, window sensors, floodlights activated by motion sensors, and even an elaborate safe room dug into the ground.

## Are they effective?

In the best of circumstances, the statistics about the efficacy of these systems is rather dubious. ADT, the premier home security system company in the United States, likes to source a statistic invented by alarms.org claiming that homes without alarms are [300% more likely](https://www.alarms.org/burglary-statistics/) to be burglarized; however, their source, [the FBI crime statistics page](https://ucr.fbi.gov/crime-in-the-u.s/2015/crime-in-the-u.s.-2015/tables/table-16), does not separate out crimes along that variable.

With this shaky evidence in mind, making a strong claim about these being effective or ineffective is impossible, the evidence simply doesn’t exist. What we do know is that despite the American population increasing, crime by absolute numbers is decreasing.

## Takeaways

You should look at your own neighborhood to see if one of these may be worth it. If you live in a rich, sleepy neighborhood in the suburbs of a major city, you’re almost certainly throwing money into a fire by paying hundreds of dollars for one of these systems. However, it could be worth it if you live in an area with more crime.

All in all, the lack of evidence about the effectiveness of these systems make it hard to justify the cost. You should do research on your local level of violence, and decide whether you think the peace of mind outweighs the cost.


Our cat diaries

Instagram Faces 405 Million Euro Fine • 2022-09-16

TikTok Denies Data Breach Allegedly Affecting 2 Billion Users • 2022-09-15

Are Credit Card Skimmers Worth Worrying About? • 2022-09-14

Phony YouTube DMCA Notice Installing Malware • 2022-09-13

Malware Could be Hiding in Images from James Webb Space Telescope • 2022-09-12

Chrome Extensions Used by 1.4 Million People Contain Malicious Cookies • 2022-09-10

More than 1,800 Android and iOS Apps Leaking AWS Data • 2022-09-09

Is it Smart to Invest in a Home Security System? • 2022-09-07