Privacy Briefing, 2.26.20

The CyberWire Pro Privacy Briefing for 2.26.20

Summary

By the CyberWire staff

At a glance.

British regulator FCA mistakenly publishes personal data.
Sports retailer exposes misconfigured ElasticSearch database.
Smart speakers are awakened by more than just intentionally spoken wake phrases.

Financial Conduct Authority inadvertently reveals personal data.

Personal data belonging to about sixteen-hundred individuals were revealed by the UK's Financial Conduct Authority (FCA), the Guardian reports. The regulator published on its website a document containing the names, addresses, and telephone numbers of people who complained about the agency. The exposure was inadvertent, coming in the course of a mishandled and over-sharing response to a request under the Freedom of Information Act that sought to learn the "number and nature of new complaints made against the FCA between 2 January 2018 and 17 July 2019." The FCA has apologized and said it will notify people whose addresses and phone numbers were exposed (not, however, those whose names only were published). The Authority has also reported itself to the Information Commissioner's Office, the British regulatory body that polices data use and abuse.

Retail data exposure.

Decathlon, a major sports retailer, inadvertently exposed one-hundred-thirty-two million records in an improperly secured ElasticSearch database, Computing writes. SC Magazine says the company has now shut the door, but the data, of course, have already been exposed. The information at risk includes unencrypted passwords, user names, full addresses, social security numbers, dates of birth, email address, qualifications, and unencrypted administrator logins. The incident is thought to be reportable under GDPR.

Smart speakers are over-eager responding to their wake phrases.

Researchers at Northeastern University and University College London have measured the privacy performance of smart speakers and found it wanting. The problem is essentially this: the speakers tend to eavesdrop, as often, Naked Security says, as nineteen times a day. Smart speakers respond to wake phrases, most of which will be familiar. Google Home Mini 1st generation listens for "OK Google," "Hey Google," or "Hi Google;" Apple Homepod 1st generation responds to "Hey, Siri;" Harman Kardon Invoke by Microsoft perks up when it hears "Cortana;" and the 2nd and 3rd generation of Amazon Echo Dot will hop to it when "Alexa," "Amazon," "Echo," or "Computer" are uttered in their presence. The researchers' method was to play T.V. shows within range of the devices, testing their response to whatever was being said on Gilmore Girls, Grey’s Anatomy, The L Word, The Office (which national version wasn't clear), Greenleaf, Dear White People, Riverdale, Jane the Virgin, Friday Night Tykes, Big Bang Theory, The West Wing, and Narcos. In addition to arguably providing a window into the T.V. consumption habits of academics in Boston and London, the experiment found that the devices were activated, on average, between 1.5 and 19 times during any given 24-hour period. Siri and Cortana were the busiest, but all the assistants showed some response to ambient dialogue. None of them recorded continuously or even for extended periods of time, but they responded long enough to merit inclusion in the unscientific category we would call "creepy." Apparently the smart speakers were fans of Gilmore Girls and the Office; those two shows triggered the most activations.

The research is ongoing, and the investigators intend to try to answer the following questions:

"How many activations lead to audio recordings being sent to the cloud vs. processed only on the smart speaker?"
"Do cloud providers correctly show all cases of audio recording to users?"
"Do activations depend on the TV show character’s accent, ethnicity, gender, or other factors?"
"Do smart speakers adapt to observed audio and change whether they activate in response to certain words over time?"

Selected Reading

()

DoppelPaymer Ransomware Launches Site to Post Victim's Data (BleepingComputer) The operators of the DoppelPaymer Ransomware have launched a site that they will use to shame victims who do not pay a ransom and to publish any files that were stolen before computers were encrypted.

Smart speakers mistakenly eavesdrop up to 19 times a day (Naked Security) That smart home speaker isn’t listening to everything you say, according to new research – but it is listening a lot more than it should.

Report: Global Sporting Goods Giant Leaks Spanish Employees’ Data & More (vpnMentor) The vpnMentor cybersecurity research team, led by Noam Rotem and Ran Locar, have uncovered a leaking, active database with over 123 million records and greater

Google stops indexing WhatsApp chats; other search engines still at it (Naked Security) Private chat invites aren’t meant to be unfindable, Facebook says, though a snippet of code eventually shielded them from Google indexing.

Google denies illegally slurping data off free student Chromebooks (Naked Security) Nonsense! says Google in response to a lawsuit filed by New Mexico’s AG, which accuses Google of violating COPPA’s child privacy laws.

A security mishap left Remine wide open to hackers (TechCrunch) Security is all too often focused on keeping hackers out and breaches at bay. But in the case of Remine, a real estate intelligence startup, it left its doors wide open for anyone to run rampant. Remine is a little-known but major player in the real estate analytics and intelligence market. It work…

Magecart skimmers ran keyloggers on commerce provider's we for two-and-a-half years (Computing) Ecommerce platform compromised by eight different skimmers hosted accounts for a number of high-profile organisations

Sports retailer Decathlon spills 123 million records, including unencrypted employee passwords (Computing) Improperly secured AWS ElasticSearch database contained ‘treasure trove’ of employee data, which may include UK staff

Decathlon patches database after 123 million records exposed (SC Magazine) Sporting goods retailer Decathlon put over 123 million records in the open, in a misconfigured ElasticSearch server, found security researchers at vpnMentor

FCA admits revealing confidential details of 1,600 consumers (the Guardian) Data breach involved names, addresses and phone numbers of some complainants

Android 11 to clamp down on background location access (Naked Security) Is Android finally about to get on top of the issue of apps that quietly suck up location data?

Firefox turns controversial new encryption on by default in the US (The Verge) The technology has faced criticism from lawmakers.

27M people affected by health data breaches in 2019 (Health Exec) More than 27 million people were affected by breaches of private health information (PHI) in 2019, according to a new report from Bitglass.

What Criminals Do with Your Data on the Dark Web (Advisor Perspectives) If you want to scare the heck out of yourself, read this report from VPNoverview on typical “dark web” data theft sites, including the cost for compromised data such as PayPal transfers, bank cards, and full identities.