Tag Archive for PII

Protect Yourself: Avoiding Election Season Scams

Protect Yourself: Avoiding Election Season ScamsAs we approach election day, we have all received more requests to sign petitions, fill out polls and surveys, and donate to causes and campaigns.  Scammers know that political campaigns often ask for your information and money.  Fraudsters are taking advantage of this avalanche of election messaging to pose as campaign workers.  Be on guard; participating in the democratic process shouldn’t compromise your identity.  Try these tips for performing your civic duty this November without getting duped by a scam.

Do your election research.

Scammers see elections as an opportunity to take advantage of peopleDo your election research to protect yourself from election-related scams.  Scammers target elections as opportunities to take advantage of people.  Additionally, fraudsters may call or email you, pretending to raise funds for a specific group or candidate.  Therefore, before you donate, ensure you’re contributing to a legitimate organization.

Furthermore, Take your time.  Be wary of any caller or message using pressure tactics to raise funds.

Do your research.

After researching and deciding to donate online, ensure the website is legitimate and the URL starts with “HTTPS.” Scammers can create copycat sites that look like the real thing.  Alternatively, the safest way to donate is at a local campaign office.

Be stingy with your personal information.

scams to steal personal details.Security experts say that identity thieves have used election or voter registration scams to steal personal details.  So, you should think twice about signing a petition at the farmer’s market or clicking on that link in the text urging you to register to vote.  Suzanne Sando, Senior Analyst at Javelin Strategy & Research, warns, “Scam election-themed texts sneak in between legitimate communications.  They take advantage of your sense of urgency and passion about the election, especially since the last few elections have been so emotionally charged.”

If you fill out a voter petition or survey, be picky about what you share.

  • Never give out your Social Security or driver’s license number.
  • Don’t be afraid to ask if specific fields are required.
    • Be wary when a campaign worker or pollster offers you a gift card for filling out a political survey.  Political campaigns don’t offer prizes or rewards.
    Never give out your financial information, such as credit card numbers or bank account details, when participating in a poll or survey.  Pollsters may ask for demographic or political affiliation information but should never need more.

AI impact on the election

A robocall is an automated phone call that delivers a pre-recorded messageSince 2022, there has been an explosion in the use of artificial intelligence (AI) to generate robocalls.  Every person in the U.S. is estimated to get 161 robocalls per yearA robocall is an automated phone call that delivers a pre-recorded message.  They typically rely on a computerized autodialer, a system that can place multiple calls delivering the same message simultaneously.  It’s a robot making a phone call, hence the name “robocall.”

AI can be exploited to create sophisticated robocalls that impersonate credible sources, manipulate voter sentiment, or spread misinformation.  In response to the spread of this type of fraud, the Federal Communications Commission (FCC) recently made AI-generated calls illegal.  It’s essential to be skeptical of any unexpected calls you receive from someone claiming to be a particular political candidate or celebrity, such as Tom Hanks, Taylor Swift, President Biden, or Elon Musk.

Election call spoofing

Another way scammers try to get your information is through spoofed calls.  The caller ID on your mobile may say the call is from a campaign or organization’s office, but this can be faked.  Spoofing occurs when a person hides behind a phone number that’s not assigned to the phone they’re calling from.

Social Media

Social mediaAlways perform these steps when interacting with a candidate or cause on social media.  First, before clicking a link in an election-themed social post, give it a once-over for phishing hallmarks.  Phishing hallmarks include blurry images and typos.  Hover your mouse over any links before clicking on them.  Next, be wary before sharing or re-posting election-related content you find online.  AI is increasingly being used to spread election disinformation and trick voters.  Do your research before sharing anything you find online.  Finally, trust your gut.  If they seem to be asking for too much information, do not share your information.

rb-

If you practice good cyber hygiene, the issues surrounding election-time scams are manageable.  It is important to remember several facts about voting.  It matters; this is your chance to support and voice your opinion.

You must be registered to vote.  If you register to vote publicly, opt to hand-deliver or mail in the required form rather than leave it behind.  Better yet, visit Vote.gov or your local election office to register.

  • You can only submit your vote in the ballot box or via an absentee ballot.
  • Ignore claims that you can register to vote or cast your ballot by phone, text, or email in exchange for sharing your personal information.

 

Related article

 

Ralph Bach has been in IT for a while and has blogged from the Bach Seat about IT, careers, and anything else that has caught my attention since 2005.  You can follow me on Facebook or Mastodon.  Email the Bach Seat here.

U of M Data Breach: Is Your Information Safe

U of M Data Breach:  Is Your Information Safe– Updated 10/27/2923 – This data breach compromised 230,000 individuals according to the Detroit News.

If you attended the University of Michigan, your personal information is at risk. The media was full of stories about the U-M networks being shut-down at the beginning of the semester. Now we know at least one reason why. The U-M had to shut down its networks because the U.S. educational nonprofit National Student Clearinghouse (NSC) disclosed a data breach affecting UMich. The breach also impacted 890 other institutions using NSC services across the United States. Here is the complete list.

National Student ClearinghouseNSC said that attackers gained access to its MOVEit managed file transfer (MFT) server on May 30 and stole files containing a wide range of personal information. NSC reported the breach to the Office of the California Attorney General,

On May 31, 2023, the Clearinghouse was informed by our third-party software provider, Progress Software, of a cybersecurity issue involving the provider’s MOVEit Transfer solution

What personally identifiable information 

According to Bleeping Computer the personally identifiable information (PII) stolen includes names, dates of birth, contact information, Also compromised were Social Security numbers, student ID numbers. Finally they report and some school-related records (e.g., enrollment records, degree records, and course-level data) were also stolen.

What is the National Student Clearinghouse 

The National Student Clearinghouse provides educational reporting, data exchange, verification, and research services. They provide services to roughly 22,000 high schools and around 3,600 colleges and universities. The organization says its participants enroll roughly 97% of students in public and private institutions.

Who is behind the MoveIT data breach

The Clop ransomware gang is responsible for the extensive data-theft attacks that started on May 27. The attackers leveraged a zero-day security flaw in the MOVEit Transfer secure file transfer platform.

Starting June 15, the cyber criminals began extorting organizations that fell victim to the attacks, exposing their names on the group’s dark web data leak site. The cybercrime gang is expected to collect an estimated $75-100 million in payments due to the high ransom requests.

Reports have also revealed that multiple U.S. federal agencies and two U.S. Department of Energy (DOE) entities have fallen prey to MOVEit-related these data theft and extortion attacks.

 

How you can help Ukraine!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

KOSA: A Bad Idea for Online Safety

KOSA: A Bad Idea for Online SafetyThe Kids Online Safety Act, known as KOSA, is another half-assed publicity grab. The politicians fail to address the root cause of the problem – data collection. We can all agree that social media is bad for kids. There is enough proof from multiple studies and former social media company employees. Therefore, KOSA is not the answer. It will infringe on the rights and interests of all internet users.

Kids Online Safety Act

Two-tier Internet in the U.S.To begin with, the Kids Online Safety Act, known as KOSA introduced by Senators Richard Blumenthal (D) and Marsha Blackburn (R), would establish a two-tier Internet in the U.S. The bill requires that sites that are ‘likely to be accessed by kids‘ act in the “best interest of users who are 16 or younger.” That means that all platforms would be responsible for mitigating the risk of physical or emotional harm to young users. This includes “the promotion of self-harm or suicide, encouragement of addictive behavior, enabling of online bullying or predatory marketing.” Sound nice; however, KOSA is not the solution we need. Here are some of the reasons to oppose KOSA:

Kids Online Safety Act safety

The KOSA requirements would mandate that platforms have parental controls. These government-mandated controls could be harmful to kids in abusive situations. According to Fight for the Future, a coalition of over 50 civil society groups, “KOSA risks subjecting teens who are experiencing domestic violence and parental abuse to additional forms of digital surveillance and control that could prevent these vulnerable youth from reaching out for help or support.

Additionally, the KOSA requirements would endanger VPNs (one of the government’s favorite boogey-techs). The group wrote; “… by creating strong incentives to filter and enable parental control over the content minors can access, KOSA could also jeopardize young people’s access to end-to-end encrypted technologies, which they depend on to access resources related to mental health and to keep their data safe from bad actors.”

KOSA is government censorship

seeking to make political pointsKOSA would give the President control over what people see online. The government would create a “Kids Online Safety Council” that would advise the government on implementing and enforcing KOSA. As a result, the legislation’s requirement to restrict access to topics such as sex education, LGBTQ issues, and mental health from minors could cause platforms KOSA could force platforms to self-censor just to avoid the hassle and costs.

Furthermore, Fight for the Future writes that censorship would be politically driven. “Online services would face substantial pressure to over-moderate, including from state Attorneys General seeking to make political points… KOSA would cut off another vital avenue of access to information for vulnerable youth.”

KOSA encourages more data collection

incentivize sites to collect even more informationAccording to Fight for the Future, the bill would incentivize sites to collect even more information about children to verify their ages and place further restrictions on minors’ accounts. They explain,

“Age verification may require users to provide platforms with personally identifiable information such as date of birth and government-issued identification documents, which can threaten users’ privacy, including through the risk of data breaches, and chill their willingness to access sensitive information online because they cannot do so anonymously.”

Therefore, they conclude, “Rather than age-gating privacy settings and safety tools to apply only to minors, Congress should focus on ensuring that all users, regardless of age, benefit from strong privacy protections by passing comprehensive privacy legislation.”

Kids Online Safety Act unintended consequences

unintended consequencesKOSA would also create unintended consequences. The unintended consequences include driving children to use less secure or more harmful platforms. The Kids Online Safety Act would make kids more vulnerable to online predators who could exploit their age verification information. It would also undermine the trust and communication between children and parents, as well as between platforms and users.

rb-

There are valid concerns about the impact of social media on us all. But the Kids Online Safety Act misses the point. Congress should be targeting data collection. Nearly all social media platforms and online businesses collect personal data from their users. The EFF points out that all social media firms harvest and monetize our personal data and incentivize other online businesses to do the same. The result is that detailed information about us is widely available to purchasers, thieves, and government subpoenas.

Consider location data brokers, for example. Our apps collect detailed records of our online activities without our knowledge or genuine consent. The app developers sell it to data brokers, who will in turn sell it to anyone who will pay for it. An election denier bought it to try to prove voting fraud. One broker sold data on who had visited reproductive health facilities.

If a bad actor or the government wanted to buy this data, it could probably find a way to do so. Collecting more data will not stop the bad actors from acquiring PII.

The better approach is to limit how all businesses collect personal data. This would de-incentive data collection and reduce the supply of data for bad actors.

Everybody should be allowed to make informed choices based on their own values and preferences.

 

How you can help Ukraine!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Tim Horton’s Caught Collecting Private Data

Tim Horton's Caught Collecting Private DataThe mobile app from coffee shop Tim Horton’s has been collecting vast amounts of users private data without consent. The Canadian federal privacy commission investigation began two years ago after the Financial Post reported on Tim’s contract with Radar Labs Inc. Radar Labs is a third-party U.S. firm that provided enhanced location tracking services for the app.

What Private Data Did Tim Horton’s Collect?

Tim Horton's app collected users' geolocation without their knowledge.Between May 2019 and August 2020 the Tim Horton’s app, which has four million users, collected users’ geolocation without their knowledge. The app collected personal data from users even when the apps was not being used. People who downloaded the Tim Horton’s app had their movements tracked and recorded every few minutes of every day, even when their app was not open.

Radar was able to use the information it collected in the app to identify personal location data. The app could identify a user’s home, place of work and when they visited a competitor of Tim Horton’s. Reports are the app noted when users entered a Starbucks, Second Cup, McDonald’s, Pizza Pizza, A&W, KFC or Subway. The Tim Horton’s app was even able to figure out if users had been traveling. The app generated an “event” every time users entered or left a Tim Horton’s competitor, a major sports venue, or their home or workplace. Canadian Privacy Commissioner Daniel Therrien said in a statement

Tim Horton’s clearly crossed the line by amassing a huge amount of highly sensitive information about its customers

What Happened to Tim’s?

delete the granular data it collected, and any further data derived from itAccording to the report, Tim Horton’s collected granular location data for the purpose of targeted advertising and product promotions. Even though Tim’s never used the information for those purposes. The investigation also found that there were inadequate contractual protections for users’ personal data. Commissioner Therrien commented,

The location tracking ecosystem, where details of our daily lives are treated as a commodity to be exploited to sell us products and services such as a cup of coffee, heightens the risk of mass surveillance

Based on its findings, the OPC ordered Tim Horton’s to delete the granular data it collected, and any further data derived from it and to order all third-party providers to do the same. Tim Horton’s has since complied. Additionally, the company agreed to create a privacy management program for the app and all future apps to prevent another privacy violation. The Office of the Privacy Commissioner noted, there “is a real risk that de-identified geolocation data could be re-identified.

Tim Horton’s has more than 5,100 stores in 13 countries. Most are in Canada, but there are more than 600 in the US, mostly in New York, Michigan, and Ohio.

rb-

Tim Horton’s was caught collecting illegitimate data via its app. It is a safe bet that many more apps are doing much the same with dubious consent. It is essential to always read through a user agreement before consenting. Both Apple and Android offer options on their phones to restrict how their apps track them. A step in the right direction.

How you can help Ukraine!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

GoDaddy WordPress Sites Hacked?

GoDaddy WordPress Sites Hacked?GoDaddy (GDDY), the world’s largest domain name registrar, disclosed that it had been hacked. According to reports on Monday (11/22/2021), an unknown attacker gained unauthorized access to the system used to provision the company’s Managed WordPress sites. This breach impacts up to 1.2 million GoDaddy WordPress customers. This number does not include the number of customers of websites affected by this breach.

GoDaddy logoThe company posted, We are sincerely sorry for this incident and the concern it causes for our customers,” “We, GoDaddy leadership and employees, take our responsibility to protect our customers’ data very seriously and never want to let them down.

GoDaddy resellers also compromised

On Tuesday (11/23/2021), GoDaddy confirmed that some of their resellers were also compromised in the attack. If you purchased your WordPress domains from

Assume your WordPress site has been compromised.

According to the SEC report filed by the Scottsdale, AZ-based firm, the attacker gained access via a compromised password on September 6, 2021. The attacker was discovered on November 17, 2021, when the attacker’s access was revoked. The attacker had more than two months to establish persistence, so anyone currently using GoDaddy’s Managed WordPress product should assume compromise until they can confirm that is not the case.

What happened at GoDaddy?

credentials in cleartextSeveral sites are reporting that GoDaddy stored sFTP (Secure FTP) credentials so that the plaintext versions of the passwords could be retrieved, rather than storing salted hashes of these passwords or providing public key authentication, which is industry best practice. This decision allowed an attacker direct access to password credentials without cracking them. According to their SEC filing: “For active customers, sFTP and database usernames and passwords were exposed.”

What did the attacker have access to?

The SEC filing indicates that the attacker had access to:

  • User email addresses,
  • Customer numbers,
  • Original WordPress Admin password that was set at the time of provisioning,
  • SSL private key and
  • sFTP and database usernames and passwords.

What could an attacker do with this info?

The attackers had unrestricted access to these systems for over two months. During that time, they could have:

  • Secure FTPThey have taken over these sites by uploading malware or adding a malicious administrative user. This allows them to maintain persistence and retain control of the sites even after the passwords are changed.
  • The attacker would have had access to sensitive information, including website customer PII (personally identifiable information) stored on the impacted sites’ databases.
  • Sometimes, an attacker could set up a man-in-the-middle (MITM) attack that intercepts encrypted traffic between a site visitor and an affected site.
  • The exposed email addresses and customer numbers cause increased phishing risks.

How to resecure your GoDaddy host WordPress site

GoDaddy should be notifying impacted customers. In the meantime, experts recommend that all Managed WordPress users assume that they have been breached and perform the following actions:

  1. If you run an e-commerce site or store PII (personally identifiable information) and GoDaddy verifies that you have been breached, you may be required to notify your customers of the breach.
  2. Change passwordsChange all of your WordPress passwords.
  3. Force a password reset for your WordPress users or customers.
  4. Change any reused passwords and advise your users or customers to do so. 
  5. Enable 2-factor authentication wherever possible. 
  6. Check your site for unauthorized administrator accounts.
  7. Scan your site for malware using a security scanner.
  8. Check your site’s filesystem, including wp-content/plugins and wp-content/mu-plugins, for any unexpected plugins or plugins that do not appear in the plugins menu.
  9. Be on the lookout for suspicious emails.

rb-

These GoDaddy data breaches are likely to have far-reaching consequences. GoDaddy’s Managed WordPress offering makes up a significant portion of the WordPress ecosystem, affecting site owners and their customers. The SEC filing says that “up to 1.2 million active and inactive Managed WordPress customers” were affected. Customers of those sites are most likely also affected, which makes the number of affected people much larger.


Stay safe out there!

Related article

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.