@siliconangle.com
//
A significant data leak has exposed the location data of approximately 800,000 Volkswagen electric vehicles, including models from VW, Audi, Seat, and Skoda. This breach was a result of a cloud misconfiguration within Volkswagen's software subsidiary, Cariad, which stores data on Amazon Web Services. The leaked data included real-time GPS locations, with some being accurate to within ten centimeters, along with other sensitive information. The issue came to light after a whistleblower alerted the German newspaper Der Spiegel, and security researchers from the Chaos Computer Club also helped uncover the leak.
The exposed data potentially allows for the tracking of vehicle locations and could be linked to vehicle owners, their names, and contact details. This raises serious privacy concerns, and in some instances, it was possible to even determine the travel patterns of individuals, including two German politicians. The incident highlights the critical importance of robust cloud security practices by automotive manufacturers and their software subsidiaries. While Volkswagen claims accessing the data required bypassing security mechanisms, it underscores the severe consequences of mishandling sensitive customer information.
Recommended read:
References :
- electrek.co: Massive data leak at Volkswagen exposes locations of 800,000 EV drivers, for months
- malware.news: Almost 800K electric cars' data exposed by Cariad
- Techzine Global: Volkswagen data breach highlights major privacy risks
- ciso2ciso.com: CISO2CISO article about exposed cloud server tracking 800,000 Volkswagen, Audi, and Skoda EVs.
- The Verge: The Verge report on Volkswagen leak exposing location data for 800,000 electric cars.
- Electrek: Electrek article about massive data leak at Volkswagen exposing locations of 800,000 EV drivers.
- www.techradar.com: TechRadar article about over 800,000 electric car owners and drivers having private info exposed online.
- Cybernews: 800,000 Volkswagen owners' data was left unprotected and exposed. What are your thoughts? Read more⤵️
- ciso2ciso.com: Exposed Cloud Server Tracks 800,000 Volkswagen, Audi, and Skoda EVs – Source:hackread.com
- arstechnica.com: whistleblower-finds-unencrypted-location-data-for-800000-vw-evs
- techcrunch.com: TechCrunch reports on a Volkswagen leak that exposed precise location data.
- www.engadget.com: Engadget reports huge Volkswagen data leak exposed the locations of 460,000 EV drivers.
- www.scworld.com: Almost 800K electric cars' data exposed by Cariad
- pxlnv.com: Volkswagen Subsidiary Left Vehicle Location Data Unprotected in Amazon Storage
- siliconangle.com: Location data from 800,000 Volkswagen vehicles exposed by cloud misconfiguration
- Pixel Envy: Volkswagen Subsidiary Left Vehicle Location Data Unprotected in Amazon Storage
- www.carscoops.com: VW Group had sensitive info, including GPS coordinates, of 800K+ electric vehicles exposed on an unprotected AWS database for months before it was alerted
- Ars OpenForum: Whistleblower finds unencrypted location data for 800,000 VW EVs
- SiliconANGLE: Location data from 800,000 Volkswagen vehicles exposed by cloud misconfiguration
- Techmeme: VW Group had sensitive info, including GPS coordinates, of 800K+ electric vehicles exposed on an unprotected AWS database for months before it was alerted (Thanos Pappas/Carscoops)
- toot.majorshouse.com: Why do they need the location data in the first place? Why does any company need this data? Volkswagen leak exposed location data for 800,000 electric cars
- Dataconomy: A data leak exposed the location data of approximately 800,000 Volkswagen (VW) electric vehicles (EVs) for several months, impacting vehicles from VW, Audi, Seat, and Skoda, as reported by Der Spiegel.
- Mashable: Volkswagen leak exposed location of 800,000 electric car drivers for months
- Miguel Afonso Caetano: Connected cars are great—at least until some company leaves unencrypted location data on the Internet for anyone to find.
- TechSpot: Volkswagen leak exposes private information of 800,000 EV owners, including location data
- discuss.techlore.tech: Volkswagen leak exposed location data for 800,000 electric cars
- Techlore: Volkswagen leak exposed location data for 800,000 electric cars
- jbz: Cariad has since patched the vulnerability, which had revealed data about the usage of Skodas, Audis, and Seats, as well as what Motor1 calls "incredibly detailed data" for VW ID.3 and ID.4 owners. The data set also included pinpoint location data for 460,000 of the vehicles, which Der Spiegel said could be used to paint a picture of their owners' lives and daily activities
- DMR News: Volkswagen Data Leak Exposed Location Data for 800,000 Electric Cars
- osint10x.com: Exposed Cloud Server Tracks 800,000 Volkswagen, Audi, and Skoda EVs
- Osint10x: Exposed Cloud Server Tracks 800,000 Volkswagen, Audi, and Skoda EVs
- Alex Jimenez: Volkswagen leak exposed location data for 800,000 electric cars The leak also included the emails, addresses, and phone numbers of drivers in some cases, Der Spiegel reports.
Bruce Schneier@Schneier on Security
//
The UK government has reportedly ordered Apple to create a backdoor for accessing end-to-end encrypted data in iCloud. This demand, made under the Investigatory Powers Act, seeks blanket access to all encrypted content, not just specific accounts. The law, known as the "Snoopers' Charter," prohibits Apple from even revealing the demand.
The Washington Post reported that the UK government served Apple with a “technical capability notice” requiring it to break the Advanced Data Protection encryption in iCloud for the benefit of law enforcement. This has caused alarm among privacy advocates and tech experts with many seeing it as an emergency. Experts warn that complying with the order could weaken user trust and expose sensitive data to misuse, also a backdoor for the government puts everyone at greater risk of hacking, identity theft, and fraud. It is being reported that Apple is likely to turn the feature off for UK users rather than break it for everyone worldwide.
Recommended read:
References :
- Casey Newton: Reports on Apple's potential response to the UK's demand to access encrypted iCloud data.
- jonnyevans: UK orders Apple to let it access everyone’s encrypted data
- Tao of Mac: UK Government Orders Apple to Create Global iCloud Encryption Backdoor
- Deeplinks: The Electronic Frontier Foundation (EFF) strongly opposes the UK's demand, emphasizing that weakening encryption undermines privacy and security.
- Schneier on Security: The Washington Post is that the UK government has served Apple with a “technical capability notice� as defined by the 2016 Investigatory Powers Act, requiring it to break the Advanced Data Protection encryption in iCloud for the benefit of law enforcement. This is a big deal, and something we in the security community have worried was coming for a while now. The law, known by critics as the Snoopers’ Charter, makes it a criminal offense to reveal that the government has even made such a demand.
- www.macrumors.com: UK Government Orders Apple to Create Global iCloud Encryption Backdoor
- gbhackers.com: UK Pressures Apple to Create Global Backdoor To Spy on Encrypted iCloud Access
- techcrunch.com: UK government demands Apple backdoor to encrypted cloud data report
- CyberInsider: U.K. Secretly Ordered Apple to Create Encryption Backdoor
- gbhackers.com: UK Pressures Apple to Create Global Backdoor To Spy on Encrypted iCloud Access
- Carly Page: Government officials in the UK have reportedly ordered Apple to build a backdoor that would give its authorities access to users’ encrypted iCloud data. Apple will likely stop offering its encrypted cloud storage offering, Advanced Data Protection, to users in the country
- tomas-svojanovsky.medium.com: The UK’s Secret Demand for an Apple Backdoor: What It Means for Your Privacy and Apple’s Encryption Battle
- cyberinsider.com: U.K. Secretly Ordered Apple to Create Encryption Backdoor
- 9to5Mac: It’s being reported that the British government secretly ordered to create a backdoor into all content uploaded by users anywhere in the world.
- The Register - Security: UK Home Office silent on alleged Apple backdoor order
- Matthew Green: Let’s be clear about what this article is saying. The U.K. has a law that allows it to issue “technical capability notices� to companies. These notices require the company to effectively disable, or secretly backdoor, their encryption mechanisms.
- Matthew Green: The U.K. may be preparing to issue Apple an order that forces them to (secretly) disable encryption.
- 9to5mac.com: 9to5Mac reports on the UK government's secret order for Apple to create a worldwide iCloud backdoor.
- Six Colors: This article discusses the implications of the UK government's order for Apple to implement a backdoor for end-to-end encryption.
- The Internet Review: This article discusses the UK government's mandate for Apple to create a global iCloud encryption backdoor.
- Open Rights Group: UK government seeks to break encryption in secret, with minimal accountability and potentially global impacts. They're failing in their primary duty to protect British citizens in a world where cybersecurity threats are increasing. Privacy = security. We must protect encryption!
- Anonymous ???????? :af:: It will affect users around the world: The UK's demands for Apple to break encryption is an emergency for us all. Weakening encryption violates human rights!
- arstechnica.com: The UK demands Apple break encryption to allow gov’t spying worldwide, reports say Apple last year opposed UK's secret notices demanding encryption backdoors.
- CCC: It will affect users around the world: The UK's demands for Apple to break encryption is an emergency for us all. Weakening encryption violates human rights!
- Metacurity: UK government demands Apple create an encrypted cloud backdoor
- www.computerworld.com: UK orders Apple to let it access everyone’s encrypted data
- Anonymous ???????? :af:: Government officials in the UK have reportedly ordered Apple to build a backdoor that would give its authorities access to users’ encrypted iCloud data.
- Ars Technica: UK demands Apple break encryption to allow gov’t spying worldwide, reports say Apple last year opposed UK's secret notices demanding encryption backdoors.
- www.bbc.co.uk: The UK government seeks to break encryption in secret, with minimal accountability and potentially global impacts. They're failing in their primary duty to protect British citizens in a world where cybersecurity threats are increasing. Privacy = security. We must protect encryption!
- Mark Nottingham: What can Apple do in the face of a UK order to weaken encryption worldwide? Decentralise iCloud, to start.
- @PrivacyMatters: Mastodon post on the UK demanding Apple to create a backdoor to access all iCloud content.
- securityaffairs.com: UK Gov demands backdoor to access Apple iCloud backups worldwide
- techcrunch.com: The UK government's secret demands for backdoor access to encrypted iCloud accounts is a "global emergency", critics have warned
- The Tuta Blog: Tuta.com: Apple to backdoor encryption? Round 2
- www.cybersecurity-insiders.com: UK Home Office Seeks Access to Apple iCloud Accounts
- SecureWorld News: A secret order issued by the United Kingdom's government is sparking global alarm among privacy advocates and cybersecurity experts.
- Carly Page: The UK government's secret demands for backdoor access to encrypted iCloud accounts is a "global emergency", critics have warned
- www.cybersecurity-insiders.com: CyberSecurity Insiders article about details on Home Office Apple iCloud access
- securityboulevard.com: UK Is Ordering Apple to Break Its Own Encryption
- securityboulevard.com: The United Kingdom has made a bold demand to Apple, purporting to require the company to create a backdoor to access encrypted cloud backups of all users worldwide.
- blog.cryptographyengineering.com: U.K. asks to backdoor iCloud Backup encryption
- www.helpnetsecurity.com: The UK’s secret iCloud backdoor request: A dangerous step toward Orwellian mass surveillance
- www.scworld.com: Reported UK-ordered iCloud encryption backdoor slammed
- Freedom of the Press: social.freedom.press topic about officials issued a secret order to Apple to create a backdoor for “blanket� access to encrypted data on its iCloud service for users worldwide.
- freedom.press: 📩 U.K. officials issued a secret order to Apple to create a backdoor for “blanket� access to encrypted data on its iCloud service for users worldwide. Read about how to protect yourself in our digital security newsletter (and subscribe):
- Help Net Security: The UK’s secret iCloud backdoor request: A dangerous step toward Orwellian mass surveillance
Carly Page@TechCrunch
//
The Pennsylvania State Education Association (PSEA), the largest public-sector union in Pennsylvania, has announced a significant data breach affecting over 500,000 members. The breach, which occurred in July 2024, resulted in attackers stealing sensitive personal information. PSEA is now notifying the impacted individuals about the incident and the potential risks.
The stolen data includes highly sensitive information, such as government-issued identification documents, Social Security numbers, passport numbers, medical information, and financial data like card numbers with PINs and expiration dates. Member account numbers, PINs, passwords, and security codes were also accessed. PSEA took steps to ensure, to the best of its ability and knowledge, that the stolen data was deleted.
Recommended read:
References :
- bsky.app: The Pennsylvania State Education Association (PSEA), the largest public-sector union in Pennsylvania, is notifying over half a million individuals that attackers stole their personal information in a July 2024 security breach.
- BleepingComputer: The Pennsylvania State Education Association (PSEA), the largest public-sector union in Pennsylvania, is notifying over half a million individuals that attackers stole their personal information in a July 2024 security breach.
- techcrunch.com: US teachers’ union says hackers stole sensitive personal data on over 500,000 members
- www.bleepingcomputer.com: Pennsylvania education union data breach hit 500,000 people
- The Register - Security: Attackers swipe data of 500k+ people from Pennsylvania teachers union
- The DefendOps Diaries: Understanding the PSEA Data Breach: Lessons and Future Prevention
- : The Pennsylvania State Education Association (PSEA) has sent breach notifications to over 500,000 current and former members
- Zack Whittaker: Pennsylvania's biggest union for educators had a data breach, exposing over half a million members' personal information.
- securityaffairs.com: Pennsylvania State Education Association data breach impacts 500,000 individuals
- Carly Page: The Pennsylvania State Education Association says hackers stole the sensitive personal and financial information of more than half a million of its members. PSEA said it “took steps†to ensure the stolen data was deleted, suggesting it was the target of a ransomware or data extortion attack, and subsequently paid a ransom demand to the hackers responsible
- infosec.exchange: NEW: A zero-day provider that exclusively sells to the Russian government is offering up to $4 million for flaws in Telegram. This announcement offers a glimpse into what the Russian government may be especially interested in, and willing to pay (even at a premium), right now. Sources in the industry tell me the prices offered are broadly right.
- securityaffairs.com: Zero-day broker Operation Zero offers up to $4 million for Telegram exploits
- techcrunch.com: Russian zero-day seller is offering up to $4 million for Telegram exploits
- CyberInsider: Cyber Insider article about Russian Zero-Day Firm Offering Record $4 Million for Telegram Exploits
- www.techradar.com: Data breach at Pennsylvania education union potentially exposes 500,000 victims
JournalBot@Ars OpenForum
//
General Motors and OnStar have been banned from sharing consumers’ geolocation and driver behavior data with consumer reporting agencies for the next five years, following an investigation by the Federal Trade Commission (FTC). The FTC found that GM had been collecting data through its OnStar Smart Driver program, which monitored driving habits and location, sometimes as frequently as every three seconds. This information was then sold to third-party platforms, including telematics analysis firms such as Verisk and LexisNexis, without adequate consent from customers. These third-party companies then offered the driver data to insurance companies, who used it to raise premiums for drivers deemed to be 'high risk'.
The investigation revealed that many consumers were unaware that their data was being shared and sold, with some expressing concern that it directly impacted their insurance costs. GM has acknowledged these privacy concerns and has discontinued the Smart Driver program, as well as terminated its third-party telematics relationships with LexisNexis and Verisk. As part of the settlement with the FTC, GM must now take steps to improve transparency for its customers regarding data collection practices.
Recommended read:
References :
- Ars OpenForum: GM sold geolocation and other driving data without adequate consent, FTC says.
- The Register - Security: We'll defo ask for permission next time, automaker tells FTC General Motors on Thursday said that it has reached a settlement with the FTC "to address privacy concerns about our now-discontinued Smart Driver program."
- www.ftc.gov: GM monitored and sold people’s precise geolocation data and driver behavior information, sometimes as often as every three seconds,
- Quartz: GM can't sell your location data for the next 5 years
- 9to5mac.com: The Federal Trade Commission (FTC) has taken action against General Motors and OnStar for selling location and driving behavior data from millions of GM car owners without proper consent, requiring both companies to halt such practices for five years.
- arstechnica.com: GM faces ban on selling driver data that can be used to raise insurance rates
- discuss.privacyguides.net: FTC proposes banning General Motors from disclosing geolocation and driving behavior data
- www.bleepingcomputer.com: The Federal Trade Commission (FTC) has announced action against General Motors (GM) and its subsidiary, OnStar, for unlawful collection and sale of drivers' precise geolocation and driving behavior data without first obtaining their consent.
- The Verge: Illustration: Alex Castro / The Verge General Motors and its subsidiary OnStar are banned from selling customer geolocation and driving behavior data for five years, .
- BleepingComputer: FTC orders GM to stop collecting and selling driver’s data
- BleepingComputer: The FTC has accused General Motors (GM) of collecting and selling drivers' precise geolocation and driving behavior data without their consent.
- 9to5Mac: FTC bans General Motors from selling driving data without permission, adding to case for CarPlay 2
@techcrunch.com
//
Apple has ceased offering its Advanced Data Protection (ADP) feature for iCloud users in the United Kingdom. This decision follows a reported demand from the UK government for a backdoor that would grant authorities access to encrypted user data. ADP provided end-to-end encryption, ensuring that only the user could decrypt their data stored in iCloud. Apple confirmed that this security feature will no longer be available to new users, and existing UK users will eventually need to disable it.
Apple stated it was "gravely disappointed" that ADP protections would be unavailable in the UK, especially considering the increasing data breaches and threats to customer privacy. The company emphasized the growing need for enhanced cloud storage security with end-to-end encryption. This move highlights a conflict between government surveillance and user privacy, as security experts warn this demand could set a precedent for authoritarian countries. James Baker from Open Rights Group said, "The Home Office’s actions have deprived millions of Britons from accessing a security feature. As a result, British citizens will be at higher risk."
Recommended read:
References :
- techcrunch.com: Apple has disabled its iCloud Advanced Data Protection feature for UK users after government demands for a backdoor.
- securityaffairs.com: The article discusses Apple's decision to remove iCloud's Advanced Data Protection in the UK.
- www.bleepingcomputer.com: This article discusses Apple's decision to disable the iCloud end-to-end encryption feature in the UK due to government pressure.
- Deeplinks: The piece explains Apple's decision to disable the end-to-end encryption feature for iCloud in the UK due to the government demanding backdoor access.
- Ars OpenForum: UK government wants access to all Apple user data worldwide
- billatnapier.medium.com: Apple Steps Back Their Security
- The Register - Security: Rather than add a backdoor, Apple decides to kill iCloud E2EE for UK peeps
- The Verge: The UK will neither confirm nor deny that it’s killing encryption
Mike Robinson@Tech Crawlr
//
A significant data breach at location data firm Gravy Analytics has exposed the sensitive location data of millions of users. The compromised data includes coordinates from mobile devices across the US, Europe, and Russia, with some records also linking the location data to specific apps. Popular apps like Candy Crush, Tinder, MyFitnessPal, and various others are impacted. The data was initially posted on a Russian-language forum by a hacker using the alias "Nightly".
The breadth of the breach is staggering with apps across several categories being affected including dating apps such as Grindr, games like Temple Run and Subway Surfers, transit apps such as Moovit, period trackers, religious apps including muslim prayer and christian bible apps, various pregnancy trackers, and even virtual private network (VPN) applications. It appears that these apps were co-opted by rogue members of the advertising industry to collect this data through the advertising bid stream, often without the knowledge of the app developers. This has raised concerns about how user data is being collected and sold within the advertising ecosystem.
Recommended read:
References :
- malware.news: Massive breach at location data seller: “Millions” of users affected
- www.404media.co: Hackers claim massive breach of location data giant, threaten to leak data
- Malwarebytes: Massive breach at location data seller: “Millions” of users affected
- www.techdirt.com: Gravy Analytics specializes in location intelligence, meaning it collects sensitive phone location and behavior data.
- gbhackers.com: Gravy Analytics Hit by Cyberattack, Hackers Allegedly Stole data
- Techmeme: A hack of location data firm Gravy reveals Candy Crush, Tinder, and thousands of other apps are being used to steal user location data; apps may not even know (Joseph Cox/Wired)
- Miguel Afonso Caetano: Hackers claim to have compromised Gravy Analytics, the parent company of Venntel which has sold masses of smartphone location data to the U.S. government.
- www.wired.com: Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location
- bsky.app: New from 404 Media: data hacked from location giant Gravy reveals thousands of ordinary apps hijacked to steal your location data. Candy Crush, MyFitnessPal, Tinder. Period trackers, prayer apps. Because of how data collected, apps may not even know
- www.404media.co: See the Thousands of Apps Hijacked to Spy on Your Location
- Techmeme: A hack of location data firm Gravy reveals Candy Crush, Tinder, and thousands of other apps are being used to steal user location data; apps may not even know (Joseph Cox/Wired)
- Miguel Afonso Caetano: 'Included in the hacked Gravy data are tens of millions of mobile phone coordinates of devices inside the US, Russia, and Europe. Some of those files also reference an app next to each piece of location data. 404 Media extracted the app names and built a list of mentioned apps. The list includes dating sites Tinder and Grindr; massive games such as Candy Crush, Temple Run, Subway Surfers, and Harry Potter: Puzzles & Spells; transit app Moovit; My Period Calendar & Tracker, a period-tracking app with more than 10 million downloads; popular fitness app MyFitnessPal; social network Tumblr; Yahoo’s email client; Microsoft’s 365 office app; and flight tracker Flightradar24. The list also mentions multiple religious-focused apps such as Muslim prayer and Christian Bible apps, various pregnancy trackers, and many VPN apps, which some users may download, ironically, in an attempt to protect their privacy.
- flipboard.com: Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location
Pierluigi Paganini@Security Affairs
//
Google has released the March 2025 Android Security Bulletin, which addresses 44 vulnerabilities. Notably, the update includes patches for two zero-day flaws, identified as CVE-2024-43093 and CVE-2024-50302, that are actively being exploited in the wild. The high-severity vulnerability CVE-2024-43093 is a privilege escalation flaw in the Framework component that could result in unauthorized access to "Android/data," "Android/obb," and "Android/sandbox" directories, and their respective sub-directories. CVE-2024-50302 is also a privilege escalation flaw in the HID USB component of the Linux kernel that could lead to a leak of uninitialized kernel memory to a local attacker through specially crafted HID reports.
This security update arrives after reports surfaced that Serbian authorities used one of these zero-day vulnerabilities to unlock confiscated devices. Google acknowledged that both CVE-2024-43093 and CVE-2024-50302 have come under "limited, targeted exploitation." The company has released two security patch levels to allow Android partners flexibility in addressing vulnerabilities across devices more quickly. The security patch levels are 2025-03-01 and 2025-03-05.
Recommended read:
References :
- securityaffairs.com: Reports the release of Google's March 2025 Android security update, which addresses actively exploited zero-day vulnerabilities.
- cyberinsider.com: Google Patches Two Actively Exploited Zero-Day Flaws in Android
- The Hacker News: Google's March 2025 Android Security Update Fixes Two Actively Exploited Vulnerabilities.
- bsky.app: Google has released patches for 43 vulnerabilities in Android's March 2025 security update, including two zero-days. Serbian authorities have used one of the zero-days to unlock confiscated devices.
- Information Security Buzz: Google Issues Urgent Alert for Exploited Android Vulnerabilities
gist.github.com via pushcx@Lobsters
//
A 15-year-old hacker has uncovered a significant security vulnerability related to Cloudflare's caching feature. This "zero-click deanonymization attack" can expose a user's precise location, within a 250-mile radius, without any interaction required from the user. The exploit impacts several popular platforms, including Signal and Discord, raising concerns for privacy among users. The hacker published a research paper warning about this undetectable exploit, targeted towards journalists, activists, and hackers, highlighting how attackers could send a malicious payload and reveal locations within seconds.
Multiple online cybercrime platforms including Cracked, Nulled, Sellix, and StarkRDP, have been seized by law enforcement in a large international operation. These sites, which facilitated the trading of stolen data, malware, and hacking tools, were used by over 10 million users. The operation involved authorities from multiple countries, and included arrests, property searches, and the confiscation of devices and funds. Europol reports that these platforms had generated over a million euros in illicit profits. The shutdown also targeted supporting services like financial processor Sellix and hosting service StarkRDP. Authorities indicate that these forums also offered AI-based tools to automate security vulnerability scans and enhance phishing attacks.
Recommended read:
References :
- Lobsters: Unique 0-click deanonymization attack targeting Signal, Discord and hundreds of platform
- The Hacker News: Authorities Seize Domains of Popular Hacking Forums in Major Cybercrime Crackdown
- blog.cloudflare.com: Cloudflare : Cloudflare released an outage postmortum for yesterday's incident in which multiple Cloudflare services were unavailable for almost a full hour.
- BleepingComputer: A routine attempt to block a phishing URL in Cloudflare's R2 object storage platform backfired yesterday, triggering a widespread outage yesterday that brought down multiple services for nearly an hour.
- www.bleepingcomputer.com: A routine attempt to block a phishing URL in Cloudflare's R2 object storage platform backfired yesterday, triggering a widespread outage yesterday that brought down multiple services for nearly an hour.
- BleepingComputer: A routine attempt to block a phishing URL in Cloudflare's R2 object storage platform backfired yesterday, triggering a widespread outage yesterday that brought down multiple services for nearly an hour.
- cyb_detective: An attempt to block a phishing URL in Cloudflare's R2 object storage platform backfired yesterday, triggering a widespread outage that brought down multiple services for nearly an hour.
- Anonymous ???????? :af:: An attempt to block a phishing URL in Cloudflare's R2 object storage platform backfired yesterday, triggering a widespread outage that brought down multiple services for nearly an hour.
- : Cloudflare : Cloudflare released an outage postmortum for yesterday's incident in which multiple Cloudflare services were unavailable for almost a full hour. This caused all operations against R2 object storage to fail for the duration of the incident, and caused a number of other Cloudflare services that depend on R2 to fail as well.
- bsky.app: A routine attempt to block a phishing URL in Cloudflare's R2 object storage platform backfired yesterday, triggering a widespread outage yesterday that brought down multiple services for nearly an hour.
- BleepingComputer: A routine attempt to block a phishing URL in Cloudflare's R2 object storage platform backfired yesterday, triggering a widespread outage that brought down multiple services for nearly an hour.
- : Cloudflare released an outage postmortum for yesterday's incident in which multiple Cloudflare services were unavailable for almost a full hour.
@www.forbes.com
//
Apple has agreed to a $95 million settlement to resolve a class-action lawsuit concerning its Siri voice assistant. The lawsuit alleges that Siri recorded private conversations when unintentionally activated, sharing these recordings with third parties including advertisers and human reviewers. The plaintiffs claim this happened without their consent and that they were then targeted with specific ads based on these conversations, with some citing examples of receiving ads for products or medical treatments after discussing those topics near their devices. The settlement also mentions that Apple employed contractors to listen to some of these recordings which included private and confidential conversations.
Apple denies any wrongdoing as part of the settlement. However, the agreement indicates that eligible users who owned a Siri-enabled device between 2014 and 2019 may be entitled to a payout of up to $20 per device. Class members are defined as individuals who are current or former owners of a Siri Device and reside in the US and its territories. They must also be willing to declare under oath that Apple recorded their conversations while Siri was accidentally activated. The final size of each payment will depend on the number of claims made.
Recommended read:
References :
- www.bbc.com: Report on Apple paying $95 million to settle a lawsuit about Siri listening
- www.businessinsider.com: Report about who might be eligible for a payout in the Siri settlement.
- www.forbes.com: Details of the Apple Siri settlement and how users can claim.
- Hacker News: Apple Siri Eavesdropping Payout–Here's Who's Eligible and How to Claim L: C: posted on 2025.01.04 at 09:40:24 (c=1, p=3)
- www.forbes.com: Apple Siri Eavesdropping Payout—Here’s Who’s Eligible And How To Claim
- www.apple.com: Our longstanding privacy commitment with Siri
- The Verge: The Verge article on Apple refuting rumors about Siri and advertising.
- Quartz: Apple says Siri isn't eavesdropping and selling your data
- www.benzinga.com: Apple Clarifies Siri Privacy Policy After $95 Million Settlement Over Allegations Of Unauthorized Recordings
@www.forbes.com
//
A new report by Citizen Lab and the EFF Threat Lab has uncovered critical security vulnerabilities within the popular Chinese social media application, RedNote. The analysis, conducted on version 8.59.5 of the app, revealed that RedNote transmits user content, including viewed images and videos, over unencrypted HTTP connections. This exposes sensitive user data to potential network eavesdroppers, who can readily access the content being browsed.
Additionally, the report highlights that the Android version of RedNote contains a vulnerability that could allow attackers to access the contents of files on a user's device. The app also transmits device metadata without adequate encryption, sometimes even when using TLS, potentially enabling attackers to learn about a user's device screen size and mobile network carrier. Despite responsible disclosures to RedNote and its vendors NEXTDATA and MobTech in late 2024 and early 2025, no response has been received regarding these critical security flaws.
Recommended read:
References :
- citizenlab.ca: The report highlights three serious security issues in the RedNote app.
- Deeplinks: The EFF Threat Lab confirmed the Citizen Lab findings about Red Note.
- www.forbes.com: Is RedNote Safe? Here's What Millions of TikTok Users Need to Know
- Deeplinks: Crimson Memo: Analyzing the Privacy Impact of Xiaohongshu AKA Red Note
@www.cnbc.com
//
DeepSeek AI, a rapidly growing Chinese AI startup, has suffered a significant data breach, exposing a database containing over one million log lines of sensitive information. Security researchers at Wiz discovered the exposed ClickHouse database was publicly accessible and unauthenticated, allowing full control over database operations without any defense mechanisms. The exposed data included user chat histories, secret API keys, backend details, and other highly sensitive operational metadata. This exposure allowed potential privilege escalation within the DeepSeek environment.
The Wiz research team identified the vulnerability through standard reconnaissance techniques on publicly accessible domains and by discovering unusual, open ports linked to DeepSeek. The affected database was hosted at oauth2callback.deepseek.com:9000 and dev.deepseek.com:9000. Researchers noted the ease of discovery of the exposed data and the potential for malicious actors to have accessed it. DeepSeek has been contacted by security researchers, and has now secured the database after the discovery, however, it remains unclear if unauthorized third-parties were also able to access the information.
Recommended read:
References :
- NewsGuard's Reality Check: NewsGuard: with news-related prompts, DeepSeek's chatbot repeated false claims 30% of the time and provided non-answers 53% of the time, giving an 83% fail rate (NewsGuard's Reality Check)
- www.theregister.com: Upgraded China's DeepSeek, which has rattled American AI makers, has limited new signups to its web-based interface
- Pyrzout :vm:: Social.skynetcloud.site post about DeepSeek's database leak
- www.wired.com: Wiz: DeepSeek left one of its critical databases exposed, leaking more than 1M records including system logs, user prompt submissions, and users' API keys (Wired)
- ciso2ciso.com: Guess who left a database wide open, exposing chat logs, API keys, and more? Yup, DeepSeek
- The Hacker News: DeepSeek AI Database Exposed: Over 1 Million Log Lines, Secret Keys Leaked
- Wiz Blog | RSS feed: Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History | Wiz Blog
- www.theverge.com: News about DeepSeek's data security breach.
- www.wired.com: Wired article discussing DeepSeek's AI jailbreak.
- arstechnica.com: Report: DeepSeek's chat histories and internal data were publicly exposed.
@The DefendOps Diaries
//
Vivaldi browser has integrated Proton VPN directly into its system, offering users a seamless way to protect their data from 'Big Tech' surveillance. The integration means users can now access VPN services without the need for external downloads or plugin activations. This move signifies a commitment to enhancing user privacy and challenging the data collection practices of major tech firms. The VPN button is available directly in the toolbar to improve user experience.
Vivaldi's partnership with Proton VPN brings browser-level privacy tools to users, allowing them to encrypt all internet traffic and protect them from persistent tracking. When enabled, browsing activity is transmitted through Proton VPN's encrypted tunnels, which obfuscates the user's IP address. The integration aims to provide enhanced protection against tracking and surveillance and sets new standards in digital security.
Recommended read:
References :
- CyberInsider: Privacy-focused browser Vivaldi has announced the direct integration of Proton VPN, offering users seamless VPN access without external downloads or plug-ins.
- Sam Bent: Vivaldi's new partnership with Proton VPN brings browser-level privacy tools into the hands of users, but it's crucial to understand where privacy ends and anonymity begins. This move is a strong statement against Big Tech surveillance, yet the protection it offers is not a blanket solution.
- The DefendOps Diaries: Discover how Vivaldi's integration of Proton VPN enhances browser privacy and user control, setting new standards in digital security.
- BleepingComputer: Vivaldi has announced the integration of Proton VPN directly into its browser without requiring add-on downloads or plugin activations, allowing users to protect their data against 'Big Tech' surveillance for free.
- bsky.app: Vivaldi has released a new version of its browser with built-in support for ProtonVPN, now available as a VPN button in the toolbar https://vivaldi.com/blog/privacy-without-compromise-proton-vpn-is-now-built-into-vivaldi/
- BleepingComputer: Vivaldi has announced the integration of Proton VPN directly into its browser without requiring add-on downloads or plugin activations, allowing users to protect their data against 'Big Tech' surveillance for free.
@www.theverge.com
//
Washington state has filed a lawsuit against T-Mobile regarding the 2021 data breach that exposed the personal information of approximately 79 million people nationwide, including over 2 million Washington residents. The lawsuit alleges that T-Mobile was aware of security vulnerabilities for years but failed to address them, leading to the breach that began in March 2021 and went unnoticed for six months. The state claims the company also inadequately notified affected customers and downplayed the severity of the incident which involved sensitive information being sold on the dark web.
The lawsuit further asserts T-Mobile did not meet industry standards for cybersecurity and used weak passwords for accounts with access to consumer data. Washington Attorney General Bob Ferguson stated that the breach was avoidable, criticizing T-Mobile’s failure to fix known vulnerabilities. In addition to seeking compensation for those impacted, the state is also seeking a court order mandating T-Mobile to improve its cybersecurity practices, enhance transparency in future incidents, and align with industry standards. It has also been revealed that T-Mobile may have hired a third party firm to purchase leaked data in an attempt to prevent it being sold more widely.
Recommended read:
References :
- www.bleepingcomputer.com: Washington state sues T-Mobile over 2021 data breach security failures
- The Verge: T-Mobile is under fire again over its 2021 data breach
- 9to5mac.com: 9to5Mac article on Washington state suing T-Mobile over the data breach.
@go.theregister.com
//
Gravy Analytics is facing a new lawsuit following a data breach that allegedly compromised the location data of tens of millions of smartphones. This marks the fourth lawsuit against the company since January 2025, accusing them of failing to adequately protect personal data. The information, which includes precise coordinates harvested from installed apps, is feared to have been stolen from the analytics firm's AWS S3 storage buckets.
A complaint filed in federal court in northern California alleges that a massive archive containing the geo-locations of people's phones has been compromised. Gravy Analytics confirmed a data security breach occurred, which was discovered on January 4, 2025. The FTC previously banned Gravy Analytics and its subsidiary Venntel from selling sensitive location data in December 2024, and this latest breach only raises additional concern about data privacy.
Recommended read:
References :
- ciso2ciso.com: Coordinates of millions of smartphones feared stolen, sparking yet another lawsuit against data broker – Source: go.theregister.com
- The Register: Coordinates of millions of smartphones feared stolen, sparking yet another lawsuit against data broker Fourth time’s the harm? Gravy Analytics has been sued yet again for allegedly failing to safeguard its vast stores of personal data, which are now feared stolen. And by personal data we mean information including the locations of tens of millions of smartphones, coordinates of whi…
- go.theregister.com: Coordinates of millions of smartphones feared stolen, sparking yet another lawsuit against data broker
- ciso2ciso.com: Coordinates of millions of smartphones feared stolen, sparking yet another lawsuit against data broker – Source: go.theregister.com
- Pyrzout :vm:: Coordinates of millions of smartphones feared stolen, sparking yet another lawsuit against data broker
- The Register - Security: Coordinates of millions of smartphones feared stolen, sparking yet another lawsuit against data broker
@securityonline.info
//
A critical security vulnerability, identified as CVE-2024-8474, has been discovered in the OpenVPN Connect application. This flaw affects versions prior to 3.5.0, and stems from the application logging the user's private key in clear text within the application log. A malicious actor who gains access to a device running a vulnerable version of OpenVPN Connect could potentially extract this private key, using it to decrypt the user's VPN traffic. This vulnerability makes VPN protection completely ineffective. OpenVPN Connect is a widely used client application, boasting over 10 million downloads on the Google Play Store, making it vital for users to be aware of this threat.
To address this, OpenVPN has released version 3.5.1, which fixes the key leakage vulnerability. While this latest update also addresses a separate app stability issue, users are strongly encouraged to update as soon as possible to ensure their protection. As a precautionary step it's recommended users check application logs for any suspicious activity if they were using a vulnerable version, and to change their VPN usernames and passwords. The OpenVPN Connect app itself requires users to connect to a separate VPN server. Users should remain vigilant for potential security risks and make it a habit to keep software updated.
Recommended read:
References :
- cR0w :cascadia:: OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic
- securityonline.info: CVE-2024-8474: OpenVPN Connect Vulnerability Leaks Private Keys
- securityonline.info: CVE-2024-8474: OpenVPN Connect Vulnerability Leaks Private Keys
- nvd.nist.gov: OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthorized actor can use to decrypt the VPN traffic
|
|
FlagThis - #privacy