31
TeamViewer installs suspicious font only useful for web fingerprinting
A weird almost unreadable font file bundled with TeamViewer for Windows software lets website detect if you’ve installed the software. Raises privacy concerns.
32
Tim Hortons app violated laws in collection of ‘vast amounts’ of location data
GATINEAU, QC , June 1, 2022 – People who downloaded the Tim Hortons app had their movements tracked and recorded every few minutes of every day, even when their app was not open, in violation of Canadian privacy laws, a joint investigation by federal and provincial privacy authorities has found.
33
UK Government Officials Infected with Pegasus
We confirm that in 2020 and 2021 we observed and notified the government of the United Kingdom of multiple suspected instances of Pegasus spyware infections within official UK networks, including the Prime Minister’s Office and the Foreign and Commonwealth Office.
34
I hacked my car
Note: As of 2022/10/25 the information in this series is slightly outdated. See Part 5 for more up to date information. The Car Last summer I bought a 2021 Hyundai Ioniq SEL. It is a nice fuel-efficient hybrid with a decent amount of features like wireless Android Auto/Apple CarPlay, wireless phone charging, heated…
35
Reverse Engineering TikTok's VM Obfuscation
TikTok has a reputation for its aggressive data collection. The platform has implemented various methods to make it difficult for reverse-engineers to understand exactly what data is being collected and how it is being used.
36
1Password Has Raised $620M
As our online lives become subject to new and evolving threats, we're doubling down on protecting the digital privacy and peace of mind of everyday people – at home and at work.
37
EasyList is in trouble and so are many ad blockers
One of the world’s most popular ad blocking filter lists, EasyList, has run into a serious issue that threatens to tank it, as well as many open-source projects that rely on it. See if this affects you personally, and how you can help.
38
I read the federal government’s Zero-Trust Memo so you don’t have to
Yesterday, the Office and Management and Budget (OMB) released a memo:“Moving the U.S. Government Towards Zero Trust Cybersecurity Principles”. The memo…
39
You can change your number
Millions of people worldwide rely on Signal every day for secure and private communication. Some of these people change their phone number, but want to continue using Signal without registering for a new account. We now provide the ability to change the phone number on your Signal account, while ...
40
EU Commission is planning automatic CSAM scanning of private communications
This would be the worst surveillance apparatus outside of China, and completely disproportionate.
41
Facebook tracking is illegal in Europe
Meta must pay 1.2 billion euros for violating the EU regulation GDPR.
42
Detecting unauthorized physical access with beans, lentils and colored rice (2021)
strengthening digital self-defense | research and development | providing privacy-focused goods and services
43
New documents reveal scale of US Government’s cell phone location data tracking
Thousands of previously unreleased records illustrate how government agencies sidestep our Fourth Amendment rights.
44
SMS phishing is way too easy
Impersonating someone in SMS texts is way too easy, we must change this to prevent social engineering fraud.
45
Ken Thompson really did launch his "trusting trust" trojan attack in real life
Ken Thompson's "Trusting Trust" compiler Trojan attack was not just a thought experiment. In fact, Usenet poster Jay Ashworth stated that, from personal communications, Thompson really did launch this attack in real life and successfully compromised the Unix Support Group at Bell Labs. Recently, I've rediscovered this…
46
Your compliance obligations under the UK’s Online Safety Bill
L ast month I wrote a post about the UK’s “world-leading” vision for age-gating the open web. It got a bit of attention . That post, sadly, encompassed only one aspect of your compliance obligations under the Online Safety Bill . In this post, I’m going to tell you about the rest.
47
Memory Safe Languages in Android 13
Posted by Jeff Vander Stoep For more than a decade, memory safety vulnerabilities have consistently represented more than 65% of vulnerab...
48
You can now ask Google to remove your phone number, email or address from search
Google said this week it is expanding the types of data people can ask to have removed from search results, to include personal contact information like your phone number, email address or physical address. The move comes just months after Google rolled out a new policy enabling people under the age of 18 (or a…
49
An update on the threat landscape
Online security is extremely important for people in Ukraine and the surrounding region right now. Government agencies, independent newspapers and public service provide…
50
Microsoft bakes a VPN into Edge and turns it on
Microsoft has bundled a VPN with its Edge browser, and we expect others to follow suit. But can a built-in VPN replace a full-fledged VPN service, and is it a good example to follow? We give our take.
51
52
What's the deal with all those weird wrong-number texts?
Digging into the world of "pig-butchering" scams
53
BundesMessenger, a secure messenger for Germany’s public administration
BundesMessenger is a modified version of Element which we’re working with BWI to develop and maintain.
54
Gnome patent troll stripped of patent rights
A recent decision at the US patent office may well give patent trolls cause to steer clear of open source projects – even more than the fierce resistance the community impressively funded and mount…
55
Removing SMS support from Signal Android (soon)
For many years, the Signal app on Android has supported sending and receiving plaintext SMS and MMS messages in addition to Signal messages. SMS and MMS are standardized communication protocols that allow mobile devices to send and transmit messages, and most people picking up their phone to text...
56
Toyota suffered a data breach by accidentally exposing a secret key on GitHub
On October 7th, Toyota revealed a partial copy of their T-Connect source code had been accidentally exposed for 5 years, including access to data for over 290,000 customers.
57
OpenSSL 3.0.7 fixes X.509 email address buffer overflows
Today we published an advisory about CVE-2022-3786 (“X.509 Email Address Variable Length Buffer Overflow”) and CVE-2022-3602 (“X.509 Email Address 4-byte Buffer Overflow”).
58
TIL: You can access a user’s camera with just HTML
The HTML capture attribute is interesting because it allows you to activate a user's camera with just HTML. This article covers it in more depth.
59
Crazy Thin ‘Deep Insert’ ATM Skimmers
A number of financial institutions in and around New York City are dealing with a rash of super-thin “deep insert” skimming devices designed to fit inside the mouth of an ATM’s card acceptance slot. The card skimmers are paired with tiny pinhole cameras that are cleverly disguised as part of the cash machine. Here’s a…
60
An Ode to Apple’s Hide My Email
Apple's Hide My Email feature is one of the most under-rated privacy launches of the past year, and here's why.