The Tor Project, the organization behind the Tor anonymity network, has published financial documents for the past two years, and while they show that its revenue has increased significantly, it’s still small compared to the budgets of potential adversaries.

According to the Tor Project, its revenue in 2015 and 2016 was roughly $3.2 million, but increased to over $4.1 million in 2017.

Tor started off as a US government project and most of its funding has come from there for many years. In 2015, for instance, 85% of the Tor Project’s funding came from US government sources. However, in 2016 that percentage dropped to 76% and last year it went further down to 51%.

Financial documents for 2017 show that nearly $600,000 came from the Swedish International Development Cooperation Agency, which is the only non-US government organization that contributed to the project. The non-government sources of revenue include Mozilla ($522,000), DuckDuckGo ($25,000), New Venture Fund ($347,000), and individual donations ($425,000).

“Tor’s budget, even at the 2017 level, remains modest considering the number of people involved and the impact we have. And it is dwarfed by the budgets that our adversaries are spending to make the world a more dangerous and less free place,” explained Roger Dingledine, one of the founders of the Tor Project and an early developer of Tor.

It’s worth noting that, back in 2015, the US government was said to have paid Carnegie Mellon University at least $1 million to find a way to deanonymize Tor users suspected of conducting criminal activities.

The Tor Project reported having 21 employees and 3,000 volunteers in 2017. The number of volunteers was roughly the same as in the previous year, but the number of employees increased from 16.

Dingledine also sought to alleviate concerns that governments may be paying for “something bad.”

“The way it works is that we try to find groups with funding for the general area that we want to work on, and then we go to them with a specific plan for what we’d like to do and how much it will cost, and if we’re lucky they say ok. There is never any point where somebody comes to us and says ‘I’ll pay you $X to do Y’,” he explained.

Related: Tor Offers $4,000 Per Flaw in Public Bug Bounty Program

Related: Cloudflare Launches Security Service for Tor Users

Related: Zerodium Discloses Flaw That Allows Code Execution in Tor Browser

http://feedproxy.google.com/~r/Securityweek/~3/wv_NICTXla4/tor-project-releases-financial-documents

A newly enacted law rushed through Australia’s parliament will compel technology companies such as Apple, Facebook and Google to disable encryption protections so police can better pursue terrorists and other criminals.

Cybersecurity experts say the law, the first of its kind globally, will instead be a boon to the criminal underworld by undermining the technical integrity of the internet, hurting digital security and user privacy.

“I think it’s detrimental to Australian and world security,” said Bruce Schneier, a tech security expert affiliated with Harvard University and IBM.

The law is also technically vague and seems contradictory because it doesn’t require systematic weaknesses — so-called “backdoors” — to be built in by tech providers. Such backdoors are unlikely to remain secret, meaning that hackers and criminals could easily exploit them.

Backdoors were central to a 1990s U.S. effort to require manufacturers to install a so-called “Clipper chip ” into communications equipment so the government could listen in on voice and data transmissions. U.S. law enforcement officials, including Deputy Attorney General Rod Rosenstein, are again pushing for legislation that would somehow give authorities access to secure communications.

The Australian bill is seen by many as a beachhead for those efforts because the nation belongs to the “Five Eyes” security alliance with the U.S., Britain, Canada and New Zealand.

“There is a lot here that doesn’t make any sense,” Schneier said of the Australian bill. “This is a technological law written by non-technologists and it’s not just bad policy. In many ways, I think it’s unworkable.”

A leading figure in cryptography, Martin Hellman of Stanford University, said it appears the bill would “facilitate crime by weakening the security of the affected devices.” 

The law won final legislative approval late Thursday, parliament’s final session of the year. Prime Minister Scott Morrison said it was urgently needed.

“This was very important legislation to give police and security agencies the ability to get into encrypted communications,” he told Nine Network television. “Things like WhatsApp, things like that which are used by terrorists and organized criminals and indeed pedophile rings to do their evil work.”

He noted that the opposition Labor Party “had to be dragged to the table” and backed the legislation as an emergency measure out of concern extremists could target Christmas-New Year crowds.

Labor lawmakers they want amendments passed when parliament resumes in February. Opposition leader Bill Shorten said he supported the current bill only because he could not “expose Australians to increased (national security) risk.”

Duncan Lewis, director-general of the Australian Security Intelligence Organization, noted during hearings that extremists share encrypted messages that Australia’s main secret service cannot intercept or read.

President Morry Bailles of the Law Council of Australia, a leading lawyers’ group, criticized the bill’s swift parliamentary journey though lawmakers knew “serious problems exist” with giving law enforcement “unprecedented powers to access encrypted communications.”

Australian law enforcement officials have complained that the growth of end-to-end encryption in applications such as Signal, Facebook’s WhatsApp and Messenger and Apple’s iMessage could be the worst blow to intelligence and law enforcement capability in decades. Federal Police Commissioner Andrew Colvin said it hampers criminal investigations at all levels.

But Apple, in comments filed with parliament in October, argued that “it would be wrong to weaken security for millions of law-abiding customers in order to investigate the very few who pose a threat.”

The company’s iPhones, because of their strong encryption, are bulwarks of national security around the globe and help protect journalists, human rights workers and people living under repressive regimes.

“The iPhone is national security infrastructure right now,” said Schneier. “Every Australian legislator uses the systems and devices that that law will target and making them insecure seems like a really bad idea.”

Apple also complained in October that the bill was “dangerously ambiguous.”

One apparent contradiction confounds technologists. The legislation says the government “must not require providers to implement or build systemic weaknesses in forms of electronic protection (‘backdoors’)” but also says it can “require the selective deployment of a weaknesses or vulnerability in a particular service, device or item of software on a case-by-case basis.”

Technologists say that the mathematics underlying encryption and the manner in which it is encoded into software make it impossible to decrypt a single user’s communications without affecting all users.

Eric Wenger, director of cybersecurity and privacy policy for the U.S. technology giant Cisco Systems, warned during debate on the bill that Australia could be at a competitive disadvantage if its data was not regarded as secure.

Australia was a major driver of a statement agreed to at the Group of 20 leaders’ summit in Germany last year that called on the technology industry to provide “lawful and non-arbitrary access to available information” needed to protect against terrorist threats.

http://feedproxy.google.com/~r/Securityweek/~3/9mGHfTzXqjA/australia-anti-encryption-law-rushed-passage

The European Union and its citizens should be “worried” about telecoms giant Huawei and other Chinese firms that cooperate with Beijing’s intelligence services, a senior EU official warned Friday.

European Commission Vice President Andrus Ansip issued the remarks after Meng Wanzhou, Huawei’s chief financial officer and daughter of its founder, was arrested a week ago in Canada at Washington’s request.

The White House did not specify why she was detained but mentioned longstanding US concerns over Chinese firms using stolen intellectual property and how Beijing acquires information technology.

“Do we (in Europe) have to be worried about Huawei or other Chinese companies?” Ansip asked during a press conference in Brussels.

“Yes, I think we have to be worried about those companies because they set new rules according with their IT companies, their producers,” Ansip said.

“They have to cooperate with their intelligence services. And this is about mandatory backdoors,” the former prime minister of Estonia added.

He said he has long opposed such backdoors where the firm may use chips to obtain secrets from customers, though he pointed out little was known about concrete cases.

“It’s not a good sign when companies have to open their systems for some kind of secret services,” he added. “As normal ordinary people of course we have to be afraid.”

Experts in the US see Meng’s arrest last Saturday as a toughening stand in Washington on dealing with Chinese tech firms amid longstanding concerns over cyberespionage.

Recent US federal law already bans military and government use of devices made by Huawei and fellow Chinese firm ZTE over security concerns.

Federal regulators are also in the process of implementing rules that would bar Huawei for rolling out fifth-generation, or 5G, networks in the United States.

Huawei has denied any ties to the Chinese government, but many in Washington are sceptical.

Huawei is meanwhile facing bans for 5G contracts in Australia and New Zealand, and British telecom group BT revealed on Wednesday it was removing Huawei equipment from its core cellular network.

http://feedproxy.google.com/~r/Securityweek/~3/dIv5-qwxKx8/eu-should-worry-about-huawei-other-chinese-firms-official

A new class action filed against Marriott following the massive data breach alleges that the hotel giant’s systems are affected by a serious vulnerability that still exposes customer information.

Several lawsuits have been filed against Marriott after the company revealed that hackers had access to its systems since at least 2014 and that they may have stolen the details of up to 500 million customers from the Starwood guest reservation database.

The latest class action, initiated by law firm Edelson in Maryland, claims that Marriott’s network is still vulnerable to cyberattacks. Edelson claims its in-house forensics lab discovered a flaw in Starwood’s internal systems that exposes a “wealth of information.”

Edelson’s complaint is redacted to avoid giving away the details of the vulnerability, but it does note that “some of the largest and most significant data breaches in recent history were carried out by leaving open access to this exact type of data.”

“[The exposed information] could provide an endless roadmap of network weaknesses and attack points. Likewise, a database of this kind offers numerous data points for phishing attacks and social engineering,” the complaint reads.

Edelson also pointed out that when individuals impacted by the breach sign up for the WebWatcher service offered by Marriott through Kroll, they relinquish their right to bring legal action.

The WebWatcher service, offered free of charge for one year, monitors websites where personal information is shared and alerts the consumer if their information is found. However, the WebWatcher terms of service include a mandatory arbitration, jury, and class action waiver.

The lawsuit highlights several past cybersecurity incidents involving Starwood and Marriott systems – including the discovery of vulnerabilities and malware – in an effort to show that the hotel company failed to take appropriate steps to secure customer information and that it violated several laws.

SecurityWeek has reached out to Marriott for comment and will update this article if the company responds.

Marriott discovered the massive breach on September 8, when one of its internal security tools detected suspicious activity related to the Starwood guest reservation database. The investigation launched by the company revealed that the unauthorized access may have dated as far back as 2014.

Individuals involved in the investigation revealed that some clues left behind by the hackers suggest that the attack may have been part of a cyber espionage operation conducted by the Chinese government.

Related: Schumer Says Marriott Should Pay to Replace Hacked Passports

Related: Espionage, ID Theft? Myriad Risks From Stolen Marriott Data

http://feedproxy.google.com/~r/Securityweek/~3/LPejGrwsiRQ/new-lawsuit-claims-marriott-still-exposes-customer-information

It has been six months since General Data Protection Regulation (GDPR) went into effect and interest in data privacy has never been higher. The trend will continue, and organizations must realize that the lens through which they view data privacy has a major impact on their business. To explore the subject further I spoke with Michelle Dennedy, Cisco’s Chief Privacy Officer (CPO), who works to raise awareness for policy, practice, and tools that protect data privacy and enable business success and innovation. 

AA: What has been the general reaction to GDPR? 

MD: As I speak with customers and my fellow CPOs, there are two general reactions. One group views GDPR is a compliance exercise. They’ve met the deadline, are exhausted, and are wondering what new directive is coming next. 

The other group considers GDPR an opportunity. They now have a map of their primary data sources and a better understanding of the level of control they have over their data. This allows them to identify data privacy gaps, the solutions needed to fill these gaps, and what’s next for their data profile. 

When we realize that GDPR is not a deadline at all but the beginning of a new era, we can start to think about how we can serve this data to make it work for the business and the data subject – that is, the employee, citizen, customer or object of observation described by the data.

AA: What are some of the most vexing data privacy challenges of our time for businesses?

MD: On a tactical level, we’re hoarding data without adequate protection. We’ve been sold a bill of goods that data is cheap, storage is cheap, and privacy is dead. Holding onto all the data that’s coming in to organizations beyond its purpose and shelf-life obscures the value and integrity of that data. 

Strategically, we’re caught between two opposing forces. There’s the inexorable global push of data – the desire to use the best data from every source to reach every market across business, science, education, and humanity. There is also the push for localization. We are driven to serve the cultures, tastes, mores and moral and ethical codes, locally. But do our laws really contemplate the global infrastructure that is our digital society? Organizations not based in the EU are affected by GDPR and its clones emerging worldwide. The time has come to marry infrastructure, architecture, and privacy engineering with policy. 

AA: Where do we go from here? 

MD: In the digital world we need to drive toward data curation. This is radically different from the preconceived notion of privacy as encryption and the secreting away or nonuse of data. Curation is about the right information at the right quality level, accessible by the right people so we are respecting and protecting privacy and using data ethically without compounding human biases. This is only possible with data engineering, privacy engineering and ethics engineering that allow us to look at what data is where, touched by whom, in benefit of whom and regulated by whom. 

AA: What makes a successful data privacy program? 

MD: You have to determine an outcome for your privacy program. That might be compliance only – learning from the past and trying to avoid mistakes and keep people out of jail. But in today’s economy, the way to leverage resources to be competitive and sustainable is to figure out how to curate data to help achieve your business objectives. Untended and uncurated assets turn into liabilities. When we are actively curating our data, we not only achieve compliance, but also efficiency, effectiveness and creativity. 

AA: What are the roles of the employee and consumer in managing privacy?

MD: We should look at the data subject as someone who is setting requirements and standards. They have the responsibility to speak up if they don’t like something, for example, if their data is being sold. They can also provide quality control. They should be asking questions that continuously push companies to think about the data they are capturing and storing, and the least amount of data required to provide a service. We can’t rely on algorithms for this type of analysis. Humans must set the tone.

AA: Can you share a few tips to help us strengthen data privacy? 

MD: For my colleagues in privacy – stay curious. Don’t just set requirements and create a check list. Stay in the game through the lifecycle of data. Whether you have a technical, legal or policy background, everyone is a “newbie” in this new space that is constantly changing. There are lots of new training opportunities, including our Privacy Sigma Riders podcast where I talk to experts who talk about everything from what’s around the corner to what we might expect 10 years from now.

Business leaders must look at data in a new way – as valuable currency. Don’t look at it as exhaust, or something that inevitably is captured, or that more is better. Think strategically about what data you need to achieve your objective. Asking for as much data as possible is like asking the CFO to give you twice as much budget as you think you’ll need, and you’ll figure out how to spend it later. Data is currency so treat it that way. 

Consumers must realize that the notion that you have no controls, or that if you want something then you need to provide all your data, is a fallacy. If consumers are not happy with what they are asked to provide, or don’t understand how to control privacy settings or how data will be used, they should speak up. Consumers have a voice and companies want to hear from them. 

http://feedproxy.google.com/~r/Securityweek/~3/OtkgY1BI8yw/data-currency-treat-it-way-strengthen-privacy

Australia Thursday passed controversial laws allowing spies and police to snoop on the encrypted communications of suspected terrorists and criminals, as experts warned the “unprecedented powers” had far-reaching implications for global cybersecurity.

There has been extensive debate about the laws and their reach beyond Australia’s shores in what is seen as the latest salvo between global governments and tech firms over national security and privacy.

Under the legislation, Canberra can compel local and international providers — including overseas communication giants such as Facebook and WhatsApp — to remove electronic protections, conceal covert operations by government agencies, and help with access to devices or services.

Australian authorities can also require that those demands be kept secret.

The conservative government had pushed for the bill to be passed before parliament rises for the year this week, saying the new powers were needed to thwart terror attacks during the festive period.

A last-minute deal was struck with the opposition Labor Party over its demands for more oversight and safeguards when the laws are used, with a review of the legislation to take place in 18 months.

The government also agreed to consider further amendments to the bill early next year.

National cyber security adviser Alastair MacGibbon said police have been “going blind or going deaf because of encryption” used by suspects.

Brushing off warnings from tech giants that the laws would undermine internet security, MacGibbon said they would be similar to traditional telecommunications intercepts, just updated to take in modern technologies.

– ‘Serious problems’ –

Global communications firms, including Google and Twitter, have repeatedly said the legislation would force them to create vulnerabilities in their products, such as by decrypting messages on apps, which could then by exploited by bad actors.

A central protection in the laws to block authorities from forcing companies to build a “systemic weakness” into their product remains poorly defined, critics say.

The Law Council of Australia, the peak body for the legal profession, said it had “serious concerns” about the changes.

“We now have a situation where unprecedented powers to access encrypted communications are now law, even though parliament knows serious problems exist,” it said in a statement.

Experts such as the UN special rapporteur on the right to privacy Joseph Cannataci have described the bill as “poorly conceived” and “equally as likely to endanger security as not”.

“Encryption underpins the foundations of a secure internet and the internet pervades everything that we do in a modern society,” Tim de Sousa, a principal at privacy and cybersecurity consultancy elevenM, told AFP.

“If you require encryption to be undermined to help law enforcement investigations, then you are ultimately undermining that encryption in all circumstances. Those backdoors will be found and exploited by others, making everyone less secure,” he said.

The new laws also include secrecy provisions, which could raise doubts over whether Australian and foreign vendors have already been compelled to act — undermining their business models where privacy is a key selling point.

The most high-profile clash over security and privacy was between Apple and the US’ FBI, when agents sought access to the data of the San Bernardino attackers in California in 2015.

Meanwhile, the Australian legislation could allow for policy laundering by its “Five Eyes” intelligence-sharing partners — Canada, Britain, New Zealand, and the United States — who cannot enact similar powers because of constitutional or human rights protections.

“There is an extraterritorial dimension to it, where for example the US would be able to make… a request directly to Australia to get information from Facebook or a tech company,” said Queensland University of Technology’s technology regulation researcher Monique Mann.

http://feedproxy.google.com/~r/Securityweek/~3/ZAt7zA5qnmA/australia-passes-cyber-snooping-laws-global-implications

Verizon-owned AOL helped advertisers track children online in order to serve targeted ads, in violation of a federal children’s privacy law, and has agreed to pay a fine of $4.95 million, New York Attorney General Barbara Underwood announced today.

“The Attorney General’s Office found that AOL conducted billions of auctions for ad space on hundreds of websites the company knew were directed to children under the age of 13,” Underwood’s announcement said. “Through these auctions, AOL collected, used, and disclosed personal information from the websites’ users in violation of COPPA [Children’s Online Privacy Protection Act], enabling advertisers to track and serve targeted ads to young children.”

In addition to paying the largest-ever fine for violating COPPA, the Verizon-owned company “has agreed to adopt comprehensive reforms to protect children from improper tracking,” the announcement said.

Verizon purchased AOL in June 2015; AOL is now part of a Verizon subsidiary called Oath, which also includes Yahoo. Verizon also operates a nationwide mobile broadband network and offers home Internet and TV services in parts of the US. Verizon has consistently fought government regulation of privacy in broadband networks. As owner of Oath, Verizon is forcing users of Yahoo services to waive their class-action rights and agree to resolve disputes through arbitration.

The attorney general investigation “examined AOL’s practices between October 2015 and February 2017,” The New York Times reported. Verizon did not admit or deny the investigation’s findings but told the Times, “We are pleased to see this matter resolved and remain wholly committed to protecting children’s privacy online.”

COPPA was enacted by Congress in 1998 and “prohibits operators of certain websites from collecting, using, or disclosing personal information (e.g., first and last name, email address) of children under the age of 13 without first obtaining parental consent,” Underwood’s announcement noted. The law was updated in 2013 to expand the definition of “‘personal information’… to include persistent identifiers that can be used to recognize a user over time and across websites, such as the ID found in a Web browser cookie or an Internet Protocol (‘IP’) address.”

The law applies to websites and online services directed at children under 13; operators of websites and online services that knowingly collect personal information from children under 13 are also covered by the law.

How Verizon violated kids’ privacy

Here’s how AOL violated COPPA, according to the NY attorney general’s office:

AOL operates several ad exchanges, including an exchange for image-based ads, referred to as “display” ads. Until recently, AOL’s ad exchange for display ads was not capable of conducting a COPPA-compliant auction that involved third-party bidders because AOL’s systems would necessarily collect information from users and disclose that information to the third parties. AOL policies therefore prohibited the use of its display ad exchange to auction ad space on COPPA-covered websites to third-parties.

Despite these policies, AOL nevertheless used its display ad exchange to conduct billions of auctions for ad space on websites that it knew to be directed to children under the age of 13 and subject to COPPA.

AOL knew the ads were directed at children in part because “several AOL clients provided notice to AOL that [more than a dozen of] their websites were subject to COPPA,” the AG’s office said. Despite that, “AOL conducted at least 1.3 billion auctions of display ad space from these websites.”

Separately, AOL “conducted at least 750 million auctions of display ad space” on hundreds of other websites. AOL knew these websites were directed at children under 13 because it had conducted an internal “review of the content and privacy policies of client websites.”

Each auction takes a fraction of a second and occurs “after a user opens a webpage that contains ad space,” the AG announcement noted. A cookie stored on a user’s computer contains information that is transmitted by the ad exchange “to entities that may be interested in purchasing ad space on behalf of advertisers.” This type of behavioral advertising targets ads at each person based on “the individual’s Internet browsing history, demographic information, or personal interests.”

AOL was guilty of still another type of violation, the AG’s announcement said. In addition to its own ad exchanges, AOL “operates a business that bids on ad space in auctions conducted by other ad exchanges.”

“Prior to November 2017, AOL’s systems ignored any information that it received from an ad exchange indicating that the ad space was subject to COPPA,” the announcement said. “Thus, whenever AOL participated in and won an auction for COPPA-covered ad space, its systems behaved as they normally did. In these cases, the company typically used user information supplied by the exchange and information the company could collect directly from the user to select and serve a targeted advertisement to the user. AOL’s collection and use of this information from users on COPPA-covered websites violated COPPA.”

AOL rep violated law to increase revenue

One AOL account manager knowingly violated COPPA in order to increase revenue, the AG investigation also found:

As described above, AOL permitted clients to use its display ad exchange to sell ad space on COPPA-covered sites, even though the exchange was not capable of conducting a COPPA-compliant auction that involved third-party bidders. AOL documents show that an AOL account manager based in New York intentionally configured at least one of these client’s accounts in a manner that she knew would violate COPPA in order to increase advertising revenue. In addition, AOL documents show that the NY account manager repeatedly represented to at least this client that AOL’s display ad exchange could be used to sell ad space to third-parties in a COPPA compliant manner. As a result of these misstatements, the client used AOL’s display ad exchange to place more than a billion advertisements on COPPA-covered inventory.

The settlement requires AOL to “establish and maintain a comprehensive COPPA compliance program” and to retain an objective, third-party expert to assess its new privacy controls.

AOL must also create new functionality for website operators that sell ads through AOL systems, allowing website operators “to indicate each website or portion of a website that is subject to COPPA.” AOL will keep that information in a database “and disclose to each third-party bidder that relevant ad space is subject to COPPA.”

“Finally, AOL has also agreed to destroy all personal information collected from children that is in its possession, custody, or control, unless such personal information is required to be maintained by law, regulation, or court order,” the settlement announcement said.

https://arstechnica.com/?p=1422609

The popular question-and-answer website Quora informed users on Monday that their information may have been stolen after someone gained unauthorized access to its systems.

Quora said it discovered the breach on November 30 and the incident is still being investigated. Do date it has determined that the attacker, described as a “malicious third party,” could have obtained information on roughly 100 million users, including name, email address, hashed password, data imported from linked networks, public content and actions (e.g. questions, answers, comments, and upvotes), and non-public content and actions (e.g. answer requests, downvotes, and direct messages).

According to Quora CEO Adam D’Angelo, users who posted anonymously are not impacted and a vast majority of the compromised data was already public on Quora. Payment card information and social security numbers are not at risk as this type of data is not collected by Quora.

The company is in the process of notifying affected users and resetting their passwords. It pointed out that “not all Quora users are affected, and some were impacted more than others.”

“While the passwords were encrypted (hashed with a salt that varies for each user), it is generally a best practice not to reuse the same password across multiple services, and we recommend that people change their passwords if they are doing so,” D’Angelo said.

Law enforcement has also been alerted – Quora hopes authorities can help identify the attacker – and a forensics and security firm has been called in to assist in the investigation.

Quora has not shared any information on the attack itself, but believes it has identified the root cause and claims to have taken steps to address the issue.

The company has set up an FAQ page where users can find information on resetting their password, obtaining a copy of their data, deleting their account, and some of the steps taken by Quora in response to the breach.

Related: 92 Million User Credentials Exposed in MyHeritage Data Breach

Related: Facebook Says Hackers Accessed Data of 29 Million Users

Related: Dell Resets User Passwords Following Data Breach

http://feedproxy.google.com/~r/Securityweek/~3/X9baGwRA-4M/quora-data-breach-hits-100-million-users

Nov 30, 2018 Marco Schiaffino Attacchi, Hacking, In evidenza, Intrusione, News, Privacy, RSS 0

---

Gli hacker sarebbero riusciti a infiltrarsi nella rete di Starwood nel 2014, ma gli amministratori di sistema se ne sono accorti solo lo scorso settembre.

Nomi, indirizzi email, estremi del passaporto e (in alcuni casi) i dati della carta di credito: i pirati informatici che hanno violato i sistemi della catena di hotel Starwood, acquisita da Marriott nel 2016, hanno decisamente fatto il colpo grosso.

Il bilancio delle vittime di questo mega-hack è infatti di 500 milioni di clienti della catena, che comprende nomi conosciuti come W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotels & Resorts, Four Points by Sheraton e Design Hotels.

Nel comunicato pubblicato su Internet da Starwood si conferma il furto di tutti i dati per circa 327 milioni di clienti e per alcuni di essi, appunto, la sottrazione anche dei dati di carta di credito che sarebbero però protetti da crittografia AES 128.

La proprietà, però, mette le mani avanti spiegando che non possono avere la certezza che i pirati non abbiano messo le mani anche sulle chiavi che ne consentono la decrittazione.

D’altra parte, stando a quanto riportato sempre nel comunicato, l’intrusione sarebbe avvenuta nel 2014 e gli hacker avrebbero potuto agire indisturbati per la bellezza di 4 anni prima che qualcuno se ne accorgesse.

Gli analisti stanno ora cercando di decrittare la copia dei dati creata dai pirati informatici (a quanto si capisce rinvenuta sui server) per capire quali informazioni siano state esattamente esfiltrate dai sistemi.

Ora Marriott ha cominciato a contattare via email tutti i clienti rimasti vittima del breach e intende offrire loro anche un servizio gratuito di monitoraggio contro il furto di identità.

Vista la timeline e la quantità siderale di tempo trascorsa tra il primo attacco e il suo rilevamento, viene però da chiedersi quanti siano già stati vittima di truffe, attacchi di phishing o furto di identità.

---

---

---

https://www.securityinfo.it/2018/11/30/violati-i-sistemi-degli-hotel-marriott-staroowd-rubati-i-dati-di-500-milioni-di-clienti/

Facebook on Wednesday said it considered charging application makers to access data at the social network.

Such a move would have been a major shift away from the policy of not selling Facebook members’ information, which the social network has stressed in the face of criticism alleging it is more interested in making money than protecting privacy.

“To be clear, Facebook has never sold anyone’s data,” director of developer platforms and programs Konstantinos Papamiltiadis said in response to an AFP inquiry.

“Our APIs have always been free of charge and we have never required developers to pay for using them, either directly or by buying advertising.”

The Wall Street Journal reported that internal emails indicating that Facebook mulled charging companies for access to user data were referred to in a lawsuit filed against the social network in 2015 by Six4Three, creator of a failed app called “Pikinis.”

The application enabled users to find Facebook pictures of people in bathing suits, taking advantage of an API feature that let apps access the data of social network users as well as their friends.

The suit accuses Facebook of abusing its power over user data. Most of the documents filed in the case have been sealed by a California judge at Facebook’s request.

Some emails indicated Facebook employees discussed providing increased access of user information to advertisers in return for spending more money on the social network, according to the WSJ.

“The documents Six4Three gathered for this baseless case are only part of the story and are presented in a way that is very misleading without additional context,” Papamiltiadis said.

– Cambridge Analytica –

Facebook early on adopted a practice of letting developers use APIs (application programming interfaces) to plug into the social network for free and connect to user data to enhance the online gathering place with games, services and more.

Facebook went public on the stock market in early 2012, and subsequently considered ways it might be able to increase revenue, opting not to charge developers for access to the social network.

Facebook in August said it has suspended more than 400 out of thousands of applications it has investigated to determine whether people’s personal information was being improperly shared.

Applications were suspended “due to concerns around the developers who built them or how the information people chose to share with the app may have been used,” according to a blog post.

Facebook contended that the suit by Six4Three is aimed at compelling the social network to provide the kind of access to friends’ data that was taken advantage of in the Cambridge Analytica privacy scandal.

Facebook admitted that up to 87 million users may have had their data hijacked by Cambridge Analytica, which was working for Donald Trump’s 2016 presidential campaign.

Facebook has modified app data sharing policies since the Cambridge Analytica scandal.

“We stand by the platform changes we made in 2015 to stop a person from sharing their friends’ data with developers,” Papamiltiadis said.

Related: Facebook Knew About Russian Activity in 2014

Related: Is Facebook Out of Control? Investigations and Complaints Are Rising

http://feedproxy.google.com/~r/Securityweek/~3/ORWBVvdmZws/facebook-mulled-charging-access-user-data