Blog

Archive for Data breach

Focus your email to protect your privacy and stay safe online.

Focus your email to protect your privacy and stay safe online.

If you are concerned about identify theft and other privacy/security concerns there is a simple email precaution you can take to protect yourself. How about – never give out your personal or business email to someone or business you don’t know?

Sounds like common sense, does it not – yet, we do it all the time! Every day we sign up for newsletters; give our email to a point of sale clerk; register for online dating; use it to get WiFi at the coffee shop or airport; register for coupons, daily deal sites and freely hand out our email address in many other situations where we don’t know the people or business. Don’t do it! Protect your privacy and stop identity theft.

Never give your personal or business email address to people or businesses you don’t know. Privacy invasions and identity theft, in most cases, start with an email address. Your personal or business email address is the key to the front door of your digital house.  Why would you ever share that key with every supplier you can think of and risk identity theft?

Little Known Fact About the Selling of Email Addresses.

Many companies have no problem selling email addresses while at the same time agreeing not to spam you. You unsubscribe from their mailing list but not from their selling list! Conclusion: Protect your privacy, don’t let your personal email get on their list in the first place

However easy it is to say, ‘never share your email with people and businesses you don’t know’, in reality we actually need to maintain a digital communications with many of these folks. Many of us simply create another email address, ‘our spam address’, in gmail, yahoo or hotmail.  We end up with another inbox that is full of spam and also contains lots of legitimate communication.

Dodoname – Privacy by Design.

Enter Dodoname, which was designed specifically for when you don’t want to use your regular email address and also want a way to start, manage and stop all these ‘other emails’.

Remember, stop identity theft, never give out your regular email address again to someone to don’t know – use a Dodoname.

Posted in: Anonymity, Data breach, Email, Fraud, Identity, Privacy, Uncategorized

Leave a Comment (0) →

The Right to Know When I Am Not Left Alone – Is Not Enough.

The Right to Know When I Am Not Left Alone – Is Not Enough.

Our online privacy is continuously compromised with the scanning, skimming and scraping of our emails and our browsing behavior.

A recent study concluded that 92% of the population believes “that collecting the content of emails is unacceptable”. How many consumers understand that virtually every email is scanned, skimmed and scraped for information and their privacy is breached every day? A recent article in The Economist describes how people do not protect their right to privacy and anonymity.

Google scans the content of all emails on its servers as well as all emails sent or received by a gmail account. Google considers that users have no ‘reasonable expectation’ of privacy. This stance flies in the face of the predominant and consistent research about consumers’ ‘privacy expectations’.

Rami Essaid recently wrote in TechCrunch that, “The truth is, people will never achieve true privacy and anonymity online.” He concludes that tracking is here to stay and that it is getting more pervasive and sophisticated. His main thesis is that our discussion should not be about absolute the right to privacy or anonymity but about transparency.

If Essaid is correct, the horse has left the barn in terms of protecting our privacy and anonymity. Instead, he proposes focusing on making it visible and transparent about how our online privacy will be accessed or ripped off.  It is OK to to invade our privacy as long as it is transparent! Should consumers simply give up that they have any expectation for online privacy? This is almost Orwellian in concept – a dark road that we must not travel as this means that others have the right to observe us without our consent!

The Right to Privacy

In 1890, Warren and Brandeis wrote The Right to Privacy and their key argument was the “right to be let alone”. Here we are 100 years later. Do we really want to change the right to be left alone to the “the right to know when I am not left alone?” Transparency is an important need but we must not give up the fight for the right to privacy.

Posted in: Anonymity, Data breach, Email, Fraud, Identity, Phishing, Privacy, Uncategorized

Leave a Comment (0) →

The week in review: the FTC on IoT at CES, ringing in a new year of data breaches and phishing scams

The week in review: the FTC on IoT at CES, ringing in a new year of data breaches and phishing scams

In our weekly roundup, we draw your attention to selected news and articles that highlight issues relating to invasions of your online privacy and threats to the security of your personal data, including problems that Dodoname can help solve. This week, the annual Consumer Electronics Show in Las Vegas highlighted the growing interest in privacy as well as the privacy impacts of the Internet of Things, ringing in the new year of data breaches, and new phishing schemes for a new year. For all our privacy, security and personal data related posts follow @MyDodoname on Twitter.

The FTC on IoT + CES = big privacy news

This week, technology companies big and small gathered in Las Vegas to tout their wares and reveal to consumers worldwide the next wave of consumer electronics. At the Consumer Electronics Show 2015, privacy was big news, both on the show floor and on the main stage.

The Internet of Things is a hot topic these days: from connected smoke alarms to intelligent refrigerators, futurists – and technology companies – are betting on the fact that soon most of our world will be connected to the Internet. This brave new world, however, has serious implications for consumer privacy.

The chairwoman of the U.S. Federal Trade Commission gave a keynote address at CES this week highlighting the privacy and security implications of IoT, and her speech got a lot of coverage in both tech and mainstream media.

“Connected devices that provide increased convenience and improve health services are also collecting, transmitting, storing, and often sharing vast amounts of consumer data, some of it highly personal, thereby creating a number of privacy risks,” she said.

This creates an opportunity, of course, for technology companies to help solve those challenges, as evidenced by the small but mighty group of privacy-focused technology providers exhibiting on the CES show floor.

Brace for a busy year of data breaches

2014 was a remarkable year for data breaches, with seemingly no corner of the retail and consumer worlds untouched by the hand of hackers and poor security systems and policies. Well, I’ve got some bad news for you: experts are predicting that 2015 could be even worse. From the Sony hack that arguably touched off international cyberwar at a magnitude never before seen to financial institutions and retail giants suffering legal action and penalties as an unprecedented rate, these are just the tip of the iceberg for what could be about to unfold in 2015.

As Forbes reported in its harbinger of the data breach potential for 2015: “…a recent study found that more than 40% of companies experienced a data breach of some sort in the past year – four out of ten companies that maintain your credit card numbers, social security numbers, health information, and other personal information.  That number is staggering, and shows no signs of retreat.”

Fast food restaurant Chick-Fil-A (which has had troubles of a different sort in recent years based on its political and religious affiliations) has the dubious distinction of being the first reported data breach of 2015. Congratulations?

What’s good on Netflix? Not the phish. Try Friends instead.

Online streaming service Netflix has fallen victim to one of the first reported phishing scams of 2015. Netflix subscribers are being targeted with the old account verification phishing scheme. Some subscribers are reporting receiving notification that their payment has failed and that they need to log in to provide updated payment details. Let’s resolve to try and not fall victim to these sorts of tactics in 2015, shall we?

 

Posted in: Blog, Data breach, Phishing, Privacy, This week in review

Leave a Comment (0) →

Digital identity = digital currency

Digital identity = digital currency

By Michael Gaffney

Your digital identity is currency. It can be monetized. In an increasingly complex digital society, one of the biggest challenges for businesses is how to capture that identity.

Currently, totally beyond the control of consumers, a myriad of technologies and companies are scraping data, watching online activity, phishing, and working tirelessly to reveal – sometimes even steal – your digital identity. Your “digital identity” is the sum of all the available information about you and is growing exponentially; at the same time, big data capabilities are keeping pace in an effort to analyze all this information, your information.

The evolution of digital identities is a concern for consumers and merchants alike. On the one hand, consumers are concerned about privacy and losing control over their personal data. On the other hand, companies are increasing worried about data breaches – be it their own or third-party applications and the effects on breaking the trusted relationship between merchants and consumers.

In February 2014, it was reported in Forbes that the cost of the data breach at Target was $61 million. Target cautioned investors, “At this time, the company is not able to estimate future expenses related to the data breach.” The breach at Target, resulting in the loss of tens of millions of digital identities has had a massive impact on value for its shareholders, not to mention consumer confidence.

It’s cold comfort for Target and the shoppers impacted that at least they’re not alone, as evidenced by this infographic of the World’s Biggest Data Breaches.

The growth rate for ecommerce far exceeds traditional economies, whose growth rates are flat to shrinking. Consumer trust is one of the cornerstones of commerce for a merchant, especially in this age of digital identities. The ecommerce world with its real-time availability, product reviews and ability to rapidly provide consumers with substitute products is a dangerous place for merchants who cannot generate trust in their products and their interactions with consumers. Protecting the digital identity of consumers is paramount to maintaining that trust.

Opt-out is considered standard practice – in fact it is legislated in many jurisdictions – as a way for consumers to control their private data. Opt-in is typically used when the data required is even more sensitive. Studies have shown that consumers want control of their data but there is juxtaposition against convenience.

Consumers are willing to share their data with private and public organizations – conditional upon privacy controls and sufficient currency benefits. Trust, plus deals that consumers like, will cause them to spend and invest in their digital identities for the merchant’s currency.

For merchants to engage the consumer – to cause them share their digital identity to unlock value – companies need to epitomize and communicate a new digital identity perspective of — responsibility, transparency and the consumer in control.

(Image: flickr, Alan O’Rourke, link)

Posted in: Blog, Data breach, Identity

Leave a Comment (0) →

The week in review: international cyberwarfare, the cost of data breaches and the future of privacy

The week in review: international cyberwarfare, the cost of data breaches and the future of privacy

By Don Dobson

In our weekly roundup, we draw your attention to selected news and articles that highlight issues relating to invasions of your online privacy and threats to the security of your personal data, including problems that Dodoname can help solve. The Sony hack was catching everyone’s attention this week, banks and retailers are arguing about footing the data breach bill and there is some new thought provoking research on our digital lives and where we are going with privacy. For all our privacy, security and personal data related posts follow @MyDodoname on Twitter.

Truth is stranger than fiction

While “The Interview” is a screwball comedy based on a highly improbable scenario, even Hollywood could not have written the script we see playing out with the Sony hack. Reports indicate that the data breach of terabytes of all manner of data (including employee personal data) at Sony was, in fact, carried out by North Korea. While state-on-state cyberwar is certainly not the personal privacy milieu of Dodoname, there are some sobering implications of the Sony hack which are likely to reverberate across business, in what may come to be seen as a real turning point for how we look at cybersecurity.

North Korea’s Bureau 121 is certainly not the only hacker group out there. In previous weeks we shared posts about how criminal hacking was a major industry in some places. A Monday post by Robert Beckhusen and Matthew Gault suggested that it wasn’t cyberwar that we need to be worried about but cybercrime, since the U.S. — and the rest of the world, for that matter — aren’t ready to deal with cybercrime. As they point out, cybercrime is often stateless. Hackers operate across borders.

When we get to the point where Crimeware-as-a-Service Threatens Banks, The Economist notes in regard to cybercrime that the growth in general wickedness online is testing the police, and underground hacker markets are peddling complete kits for hackers monetizing every piece of data they can steal or buy and are adding services, it starts to feel like, whether we like it or not, 2015 will be a watershed year for cybersecurity. With polls reporting that almost half of Americans say their card details have been stolen in a data breach, it is also no surprise to see observers suggesting that protecting consumers’ data should be at top of new Congress’ agenda.

Who pays the bill?

As the cost of data breaches starts to explode, there is mounting tension between retailers and card issuers. Banking and Credit Union association officials Jim Nussle and Camden R. Fine note the instant criminal hackers gain access to consumer financial data, they sell the information to the highest bidders. Protecting the consumer then becomes the duty of financial institutions—leaving banks and credit unions on the hook for fronting the bill. Their industry feels it’s time for retailers to join efforts to put a stop to data breaches and protect the consumer. Current U.S. laws on data protection for retailers are not as strict as financial institutions and as a result there is little incentive to address their security flaws, because financial institutions are responsible for cleaning up their mess. We expect that retailers will face increased liability as laws are almost certain to change, highlighting the potential value to retailers of participating in a privacy marketing platform like Dodoname.

The future of privacy

The Pew Research Center Internet & American Life Project aims to be an authoritative source on the evolution of the Internet through surveys that examine how Americans use the Internet and how their activities affect their lives. They canvassed thousands (2,511) of experts and Internet builders to share their predictions on the future of privacy and released the results of those efforts this week.

In theintro to the report, Pew notes “The terms of citizenship and social life are rapidly changing in the digital age. No issue highlights this any better than privacy, always a fluid and context-situated concept and more so now as the boundary between being private and being public is shifting.

We recommend the entire report as a fascinating read. It reveals that, while we all can see benefits in our ever increasing digital lifestyle, privacy does mean something. However, it’s moving so fast that all parties are struggling to decide what it does mean and where it is going. Lots of food for thought for sure, but you won’t find a simple consensus. A taste of what we mean follows and do check out the full report.

We are at a crossroads,” noted Vytautas Butrimas, the chief adviser to a major government’s ministry. He added a quip from a colleague who has watched the rise of surveillance in all forms, who proclaimed, “George Orwell may have been an optimist,” in imagining “Big Brother.”

An executive at an Internet top-level domain name operator who preferred to remain anonymous replied, “Big data equals big business. Those special interests will continue to block any effective public policy work to ensure security, liberty, and privacy online.”

John Wilbanks, chief commons officer for Sage Bionetworks, wrote, “We have never had ubiquitous surveillance before, much less a form of ubiquitous surveillance that emerges primarily from voluntary (if market-obscured) choices. Predicting how it shakes out is just fantasy.”

An information science professional responded, “Individuals are willing to give up privacy for the reasons of ease, fastness, and convenience… If anything, consumer tracking will increase, and almost all data entered online will be considered ‘fair game’ for purposes of analytics and producing ‘user-driven’ ads. Privacy is an archaic term when used in reference to depositing information online.

Joe Kochan, chief operating officer for US Ignite, a company developing gigabit-ready digital experiences and applications, observed, “I do not believe that there is a ‘right balance’ between privacy, security, and compelling content. This will need to be a constantly negotiated balance—one that will swing too far in one direction or another with each iteration… Public norms will continue to trend toward the desire for more privacy, while people’s actions will tend toward giving up more and more control over their data.”

Posted in: Data breach, Privacy, Spam, This week in review

Leave a Comment (0) →

This week in review: Cyber Monday sales and scams, the European Plan and the science behind tracking

This week in review: Cyber Monday sales and scams, the European Plan and the science behind tracking

By Don Dobson

In our weekly roundup, we draw your attention to selected news and articles that highlight issues relating to invasions of your online privacy and threats to the security of your personal data, including problems that Dodoname can help solve. Catching our attention this week were posts on Cyber Monday, ongoing privacy debates, including in Europe and the science behind who is tracking you. For all our privacy, security and personal data related posts follow @MyDodoname on Twitter.

Cyber Monday – sales and scams

Although figures vary quite widely depending on the source, a considerable fury of online sales was unleashed this week on Cyber Monday. ComScore reported U.S. sales of over $2 billion, a 17 percent increase over last year’s Cyber Monday, making this the “heaviest U.S. online spending day in history.” Predictably, this rush of e-commerce also captured the full attention of online bad actors. Researchers had already observed a “sharp increase” in phishing and spam activities against online shoppers and expect more to come into the holiday season. In a Politico article called “Hack Friday: Black Friday cybercrime is unstoppable,” Jay Healey, a former White House and financial sector official notes “Hunters are more likely to be out when there’s more prey to be hunted.” Bolstering that idea, reports on a study from security firm Imperva shows nearly half of all web application cyber-attacks target retailers. “This is largely due to the data that retail websites store – customer names, addresses, credit card details – which cyber criminals can use and sell in the cybercrime underworld,” said Amichai Shulman, chief technology officer at Imperva.

While email is still the prime vector for phishing, we were also reminded that social media is not immune to these threats riding the wave of a major online event such as Cyber Monday. Fake social media messages on platforms like Facebook attempted to hook unsuspecting shoppers looking for deals and discounts.

Privacy debates

Of course, we continue to monitor news and debates around how companies use your data to track your online activities for various advertising and marketing purposes. Indeed, providing a way to have both privacy and personalization is the raison d’être behind Dodoname. It’s fascinating to see the general public slowly becoming aware of the extent to which we are tracked. Jascha Kaykas-Wolff, the Chief Marketing Officer of BitTorrent, notes recent Pew research, saying it “overwhelmingly showed the burgeoning distrust users have harbored in putting their private information online.” His article, Why privacy is like the frog in the pot of boiling water, is descriptive of what has happened to all of us. Like the proverbial frog in the pot of water that is slowly increasing in temperature, we’ve paid little notice to the tracking and erosion of privacy. With the Pew study showing that ninety percent of adults agree that we’ve lost control of our personal data, the temperature is going to start to rise for business as well.

One way the market is responding to consumer concerns is through offers like Dodoname where privacy, rather than tracking, is central to the value proposition. Another prominent example is DuckDuckGo, a search engine that puts privacy first, rather than collecting data. Gabriel Weinberg founder of the company, speaking about privacy-based products in a Guardian Article notes “I don’t think it’s a fad. One of the big things people have noticed in the last year is the ads that follow them around the Internet and that’s perhaps the most visible notion of this new tracking mindset that most companies are adopting. Those trends are not disappearing. More tracking on the Internet, more surveillance, so I think as people find out about it they’re going to be wanting to opt out in some percentage.”

The European Plan

The European Union is ahead of North America in many regards concerning privacy, including evolving regulations concerning cookie use. We’ve previously reported on so-called super cookies and device fingerprinting used to track consumers across devices, including smartphones. A Guardian article this week Europe’s next privacy war is with websites silently tracking users, notes regulators have made it clear that companies cannot bypass cookies consent by using covert methods to track users through their devices. In the article, Jim Killock, executive director of the Open Rights Group says “Building profiles to deliver personalised content and adverts clearly falls under e-privacy and data protection law.” This regulator opinion on device fingerprinting techniques seems to pave the way for developing new legislation to govern their use and protect user privacy.

The science behind tracking you

The science behind tracking and the answer as to why techniques that track users across devices are being pursued by companies on both side of the Atlantic can be found in a MIT Technology Review article we shared this week: New Technology for Tracking Consumers Across Devices Grows Results.

Companies like Adometry are using probabilistic identification methods, to link smartphones to desktops accurately enough to justify ad placements. Drawbridge, of San Mateo, California, says it can “take anonymous signals from the device and do a kind of statistical space-time triangulation.” By performing the analysis over time, Drawbridge identifies clusters of devices and then figures out which are paired, providing confidence that they have the same user. The results provide marketers with data that is accurate enough for retargeting and attribution.

Still, we are just at the beginning of what marketers would like tracking to accomplish. As various vendors build their own technology and tech companies like Apple or Google seek dominance of their own proprietary methods, Adometry CEO, Casey Carey offers the opinion that Marketers need a new system to track customers across platforms.

Posted in: Blog, Data breach, Fraud, Phishing, Privacy, This week in review

Leave a Comment (0) →

Data brokers: a threat to your online privacy

Data brokers: a threat to your online privacy

By Don Dobson

Two facts have collided in the early days of this millennium: one, much of our lives has gone digital and two, digital security measures have not kept pace with technological advancements and adoption. This is a huge problem.

Our commerce, work, social life, entertainment, information consumption and personal communication have all become digitized. Much of everyday life has either moved online or is touched in some way by our online activity, creating a stream of data coined by Google as our “digital exhaust.”

Secondly, not just laws and regulations but even broad social consensus around issues of security and privacy are falling behind the technological curve and the ever increasing collection capabilities for our data.

Consumer advocates and organizations like the American Civil Liberties Union are sounding the alarm on an industry many consider out of control. Its new video, Invasion of the Data Snatchers, paints a scary, dystopian view of our personal lives under scrutiny by governments and corporations. The intro to the video on their YouTube channel notes New technologies are making it easier for private companies and the government to learn about everything we do – in our homes, in our cars, in stores, and within our communities. As they collect vast amounts of data about us, things are getting truly spooky!

So, who is vacuuming up this so-called digital exhaust? One set of players in that business that few people know about and fewer still understand are “data brokers.” Pam Dixon is the executive director of the World Privacy Forum and her December 18, 2013 testimony before the Senate Committee on Commerce, Science, and Transportation, titled What Information Do Data Brokers Have on Consumers, and How Do They Use It?, sheds full light on a growing industry with somewhere around 4,000 companies. Dixon asked:

What do a retired librarian in Wisconsin in the early stages of Alzheimer’s, a police officer, and a mother in Texas have in common? The answer is that all were victims of consumer data brokers. Data brokers collect, compile, buy and sell personally identifiable information about who we are, what we do, and much of our “digital exhaust.” 

We are their business models. The police officer was “uncovered” by a data broker who revealed his family information online, jeopardizing his safety. The mother was a victim of domestic violence who was deeply concerned about people finder web sites that published and sold her home address online. The librarian lost her life savings and retirement because a data broker put her on an eager elderly buyer and frequent donor list. She was deluged with predatory offers.

[Consumers] not able to escape from the activities of data brokers…until this Committee started its work, this entire industry largely escaped public scrutiny… Consumers have no effective rights because there is no legal framework that requires data brokers to offer consumers an opt-out or any other rights.

Frank Pasquale, a professor of law at the University of Maryland, is the author of the forthcoming book, “The Black Box Society: The Secret Algorithms That Control Money and Information.” He writes, Every day, corporations are connecting the dots about our personal behavior—silently scrutinizing clues left behind by our work habits and Internet use. The data compiled and portraits created are incredibly detailed, to the point of being invasive. 

In a October 16th, 2014 op-ed in the New York Times entitled, The Dark Market for Personal Data, Pasquale suggests, We need regulation to help consumers recognize the perils of the new information landscape without being overwhelmed with data.

Media investigators are starting to inform the public that the personal data being brokered can be very personal indeed. Reports from Bloomberg indicate Tapping social media, health-related phone apps and medical websites, data aggregators are scooping up bits and pieces of tens of millions of Americans’ medical histories. Even a purchase at the pharmacy can land a shopper on a health list…People would be shocked if they knew they were on some of these lists…yet millions are.

According to the Data-Driven Marketing Institute, the data-mining industry generated $156 billion in revenue in 2012. Technology CEO and Harvard professor Nathan Eagle offers up his insight on the matter … it is just the first step for the data economy. By 2020, the global Internet population will reach five billion; ten billion new machine-to-machine connections will be created; and mobile data traffic will rise 11-fold. Given the dramatic growth in the amount of data being generated, together with ever-expanding applications across industries, it is reasonable to expect that…within ten years, the data-capture industry can be expected to generate more than $500 billion annually.

The World Privacy Forum has compiled a list of 352 consumer-focused U.S. data broker sites. Check out the list and see if you’re on any of these sites. Many of the sites offer the ability for those included to opt-out; might be a good use of your time to go through that process and engage in more privacy-centric online practices in future.

With these nefarious, data grabbing institutions at large, the urgency to protect your online data, including through use of a tool like Dodoname, has never been more real.

(Image: Flickr, Simon Cunningham, link)

Posted in: Blog, Data breach

Leave a Comment (0) →

Chances are your personal data has been compromised in a data breach

Chances are your personal data has been compromised in a data breach

This Throwback Thursday, let’s travel back to a simpler time, a time when the threats to your personal data online were not as frequent or severe as now. The year was 2009.

James Cameron’s groundbreaking film Avatar reigned at the box office. The world was introduced to golden-voiced singer Susan Boyle via a viral YouTube video. Yelp was emerging as one of the top iPhone apps of the year. America struggled to recover from the financial setbacks of the previous fall. And there were a mere 778 data breaches in the U.S. that year, according to a Risk Based Security and Open Security Foundation Report. It was the best of times, it was the worst of times.

Fast forward to today, when there’s a good chance that your personal data has been compromised in a data breach. According to a CNNMoney/Ponemon Institute study, 47 percent of U.S. adults had their personal information exposed by hackers between May 2013 and May 2014. That’s a frightening statistic to behold. And that number is likely just the tip of the iceberg; retailers are decidedly cagey when sharing with the general public, the media and their customers just what data has been leaked, and so many consumers may be victims and not even know it.

The Risk Based Security and Open Security Foundation Report for 2013 provided some additional stats about how far we’ve come since 2009 in terms of the numbers of data breaches and the amount of records impacted. According to the InfoSec Institute, “During the 2,164 incidents, nearly 822 million records were exposed.” It’s not pretty, as you can see.

Databreaches2009to2013

The stats for 2014 are still being compiled, but anecdotal evidence (Adobe, ebay, Target, JP Morgan Chase… need I go on?) would suggest that it’s on track to be the worst year ever for data breaches.

Dodoname has none of your personal information. Ergo, when you use a Dodoname to engage with a retailer, they have none of your personal information. Retailers can’t knowingly or unknowingly give up information that they don’t have. As consumers become more aware of the serious risks associated with sharing personal data with retailers, we’re hoping that they’ll be open to using Dodoname to protect themselves – and their personal information – against future data breaches. With Dodoname, consumers can get the best that the web has to offer, without exposing themselves to data breaches.

(Image: Flickr, Justgrimes, link)

Posted in: #TBT, Blog, Data breach

Leave a Comment (0) →

This week in review: this machine eats privacy, malware, ApplePay retailers pay the piper, and more

This week in review: this machine eats privacy, malware, ApplePay retailers pay the piper, and more

By Don Dobson

In our weekly roundup, we draw your attention to selected news and articles that highlight issues relating to invasions of your online privacy and threats to the security of your personal data, including problems that Dodoname can help solve. Catching our attention this week were posts about technology advances that further erode your privacy, new payment system hacking, the continuing cyber-security battle for retailers and as always, lots of phishing and other email scams. For all our privacy, security and personal data related posts follow @MyDodoname on Twitter.

The privacy killing machine

We had seen previously Facebook’s move into direct competition with Google with its advertising exchange Atlas. The platform leverages your unique Facebook identifier tracking you across the web and multiple devices. ISP Verizon is also using what they call a “Unique Identifier Header.” Some critics are saying “…it’s also a reckless misuse of Verizon’s power as an internet service provider—something that could be used as a trump card to obviate established privacy tools such as private browsing sessions or “do not track” features.”

The ol’ Backoff sneak attack

We’ve previously noted many retail data breaches that compromise consumer data including personal and financial information. Retailers can be infected with at least one piece of malware and be unaware for long periods of time. Unfortunately, it appears to be getting worse as we discover in a report that says the ‘Backoff’ malware used in retail data breaches is spreading. Apparently some  recent breaches, like that at Home Depot, are resulting in credit card charges coming out of Brazil.

Hackers give CurrentC no quarter

Apple’s new payment system, ApplePay, was announced with much fanfare a couple of weeks ago. However, some retailers abruptly stopped using the system this past week. Apparently they forgot agreements they had in place to support an alternate system that precluded them for using ApplePay. The payment system, called CurrentC includes partners CVS and Rite Aid among others. It vacuums up (and promises to share) lots of personal data and has been signing up customers. However, it actually hasn’t been released for use yet and already it has been hacked and criminals managed to grab the email addresses of anyone who signed up for the program.

Phishing for Apple

The Apple ecosystem has traditionally been noted as being less subject to security concerns than its competition but that has been changing. News was revealed this week via the CYREN Internet Threats Trend Report that phishing scams targeting Apple rose 246%.

Other phishing activity noted this week involve Pizza Hut, a Michigan hospital, rocker Brett Michaels, doctors, architects, engineers and other white-collar professionals, and even Revenue Canada.

Malware hackers do seem to be more prevalent than ever so it comes as no real surprise to see a new Microsoft survey where 42% report weekly and even daily attempts to gain access to their PC or a @FindLawConsumer survey that shows 29% of U.S. adults say they’ve had their identity stolen and that 10% report being hit twice. Whether it’s a legitimate-looking invoice email hiding a data-stealing Trojan malware attack, banking malware that specifically targets sensitive user account credentials, or horse owners, unfortunately Pew Research sees a likelihood of major attacks in coming years.

Posted in: Blog, Data breach, Phishing, Privacy, This week in review

Leave a Comment (0) →

Top five online privacy concerns

Top five online privacy concerns

By Don Dobson

In epidemiology, the means for the transmission of disease is termed a “vector.” In the world of online privacy, your personal email address is one of the prime vectors by which your privacy can be compromised. If you’re not using a Dodoname to interact with merchants, you’re leaving yourself open to these top five privacy concerns (which can have some very scary repercussions!)

1. Phishing

Wikipedia defines phishing as the attempt to acquire sensitive information such as usernames, passwords, and credit card details (and sometimes, indirectly, money) by masquerading as a trustworthy entity in an electronic communication.

Although not the only means, email is one of the main vectors for phishing. At Dodoname, we like to keep up to date on the latest developments in cybercrime through email phishing scams. We see that the scammers are relentless and that anyone can be a victim: criminals shamelessly exploit the latest news, such as recent attempts linked to the Ebola scare gripping the world or even attack children. It also a big problem for businesses as employees can be fooled and surrender corporate information or provide a pathway for hacking of retailer systems.

Phishing still thrives because it remains a simple game and the power of easily sending millions of emails every day allows the bad guys to fill their quotas. Old scams are still making the rounds and claiming victims. And the fact is, email remains a very popular communication channel. Unfortunately, it’s true that real dangers can place themselves in your inbox. Here’s a start on some help to stay out of trouble and also some advice if you have taken the bait.

2. Data breaches

Retailers in particular have shown themselves to be vulnerable to hacker attacks which result in a “breach” of security measures protecting customer data, as have financial institutions.

You may think “that’s their problem” but it could also be a problem for you. Depending on the nature of the data breach, personal information you have shared with companies, including credit card information, may become available for use by criminals and/or be re-sold in criminal markets. Ironically, this can result in even more effective phishing emails as criminals use information already stolen to become more credible to email recipients in what is known as “spear-fishing.”

There is nothing you can do to prevent these breaches, but they are the top of the list of concerns for company executives. Customers are striking back. Many consumers will stop patronizing companies who have had a data breach while some victims of these attacks  have joined lawsuits against retailers like Home Depot.

3. Malware

Email phishing can have many consequences. One of those is the installation of malware on your device. There are many varieties of malware “in-the-wild,” some malicious, some not so much, but none have any business on your device. Among the types of malware that can impact you are “key-loggers,” which send back everything you type online to criminals. This information would include details of all your online activity including banking website passwords.

And the thing is, you don’t always even need to click on anything. Just visiting some sites exposes you to these sneaky downloads through “malvertising.” You might think that staying away from seedy corners of the Internet would protect you, but the truth is even reputable sites can be hacked in these ways through ad exchanges.

4. Identity theft

Identity thieves have many different ways to strike: over the phone or through something as low-tech as criminals sifting through your trash, or through email phishing attacks. Online theft of personal identity and it has become a major problem worldwide. Criminals can use your identity and credit card information to make purchases, take out loans or conduct any illicit financial transaction.

Identity thieves can be individuals at the local level or international organized criminal operations. Even using free wi-fi at a coffee shop can open you up to identity theft. It’s clear that these types of cybercrime enterprises are a growth business.

5. Data brokers

A much broader concern for personal privacy than the vector of phishing emails and malware criminals is an industry that operates “legitimately” but without much regulatory protection for consumers. Testimony by Pam Dixon, Executive Director, World Privacy Forum appearing before the Senate Committee on Commerce, Science, and Transportation, suggests that somewhere around 4,000 companies in the U.S. gather identity information left by the “digital exhaust” of your online activity. Dixon cites real harm to individuals resulting from these activities and notes “Despite the large and growing size of the industry, until this Committee started its work, this entire industry largely escaped public scrutiny. Privacy laws apply to credit bureaus and health care providers, but data broker activity generally falls outside these laws. Even a knowledgeable consumer lacks the tools to exercise any control over his or her data held by a data broker.” 

(Image: Flickr, Sebastien Wiertz, link)

 

 

 

 

 

 

 

 

Posted in: Blog, Data breach, Email, Fraud, Identity, Phishing, Privacy

Leave a Comment (0) →
Page 1 of 2 12