{"id":14819,"date":"2018-04-01T16:23:38","date_gmt":"2018-04-01T23:23:38","guid":{"rendered":"https:\/\/www.podfeet.com\/blog\/?p=14819"},"modified":"2018-04-01T16:24:31","modified_gmt":"2018-04-01T23:24:31","slug":"sb-sesta-fosta-cloud-act-apples-hsts-clever-fix","status":"publish","type":"post","link":"https:\/\/www.podfeet.com\/blog\/2018\/04\/sb-sesta-fosta-cloud-act-apples-hsts-clever-fix\/","title":{"rendered":"Security Bits &#8211; SESTA\/FOSTA, CLOUD Act, Apple&#8217;s HSTS Clever Fix"},"content":{"rendered":"<h3>Followups<\/h3>\n<ul>\n<li>Cambridge Analytica &amp; Facebook Kerfuffle Followup\n<ul>\n<li>Additional developments:<\/li>\n<ul>\n<li>It&#8217;s been revealed that Facebook scraped call and text data from Android phones for years. Technically users did opt in to the collection, but it doesn&#8217;t seem to have been informed consent based on the public reaction to the reporting:\n<ul>\n<li><a href=\"https:\/\/arstechnica.com\/information-technology\/2018\/03\/facebook-scraped-call-text-message-data-for-years-from-android-phones\/\">Facebook scraped call, text message data for years from Android phones [Updated] \u2014 arstechnica.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.imore.com\/iphone-protected-you-facebook-call-scraping-android-not-so-much\">iPhone protected you from Facebook call scraping. Android, not so much. \u2014 www.imore.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/27\/of-course-facebook-logs-calls-and-texts-people-gave-it-permission\/\">Of course Facebook logs calls and texts \u2013 people gave it permission \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>&#x1f1fa;&#x1f1f8; The FTC is investigating Facebook \u2014 <a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/28\/ftc-goes-after-facebook\/\">nakedsecurity.sophos.com\/\u2026<\/a> &amp; <a href=\"https:\/\/www.imore.com\/ftc-says-it-has-open-non-public-investigation-facebook\">www.imore.com\/\u2026<\/a><\/li>\n<p><!--more--><\/p>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/28\/cambridge-analyticas-secret-coding-sauce-allegedly-leaked\/\">Cambridge Analytica\u2019s secret coding sauce allegedly leaked \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li>Mozilla have released a FireFox plugin to sand-box Facebook and hence limit its tracking abilities \u2014 <a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/29\/firefox-add-on-limits-facebooks-tracking-of-you\/\">nakedsecurity.sophos.com\/\u2026<\/a> &amp; <a href=\"https:\/\/www.imore.com\/firefox-has-new-extension-prevent-facebook-snooping-you\">www.imore.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/29\/facebook-revamps-security-privacy-settings-following-huge-data-scandal\/\">Facebook revamps security, privacy settings following huge data scandal \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.macobserver.com\/news\/tim-cook-well-crafted-regulation\/\">Tim Cook Calls for \u2018Well-Crafted\u2019 Regulation Protecting Privacy \u2014 www.macobserver.com\/\u2026<\/a>\n<ul>\n<li><strong>Related<\/strong> <a href=\"https:\/\/arstechnica.com\/tech-policy\/2018\/03\/tim-cook-says-apples-customers-are-not-its-products-unlike-facebook\/\">Tim Cook says Apple\u2019s customers are not its product, unlike Facebook \u2014 arstechnica.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Facebook stops incorporating data from third-party services to augment the data it gathers itself \u2014 <a href=\"https:\/\/www.recode.net\/2018\/3\/28\/17174098\/facebook-data-advertising-targeting-change-experian-acxiom\">www.recode.net\/\u2026<\/a> &amp; <a href=\"https:\/\/www.imore.com\/facebook-ending-its-relationships-third-party-data-brokers\">www.imore.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.imore.com\/facebook-pushing-back-its-smart-speaker-following-privacy-concerns\">Facebook is pushing back its smart speaker following privacy concerns \u2014 www.imore.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<ul>\n<li>Additional Hints, Tips, Advice &amp; Opinion Pieces:\n<ul>\n<li><strong>Opinion<\/strong> <a href=\"https:\/\/mondaynote.com\/mark-zuckerberg-thinks-were-idiots-638c64dfab12\">Mark Zuckerberg Thinks We\u2019re\u00a0Idiots. \u2014 mondaynote.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.imore.com\/how-download-copy-your-facebook-data\">How to download a copy of your Facebook data \u2014 www.imore.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.intego.com\/mac-security-blog\/how-to-prevent-facebook-apps-from-accessing-your-profile-information\/\">How to Prevent Facebook Apps from Accessing Your Profile Information \u2014 www.intego.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.macobserver.com\/tips\/quick-tip\/facebook-profile-different-person\/\">Test Your Facebook Privacy by Viewing Your Profile as a Different Person \u2014 www.macobserver.com\/\u2026<\/a><\/li>\n<li>Remember that Facebook is not the only company who&#8217;s business model is built around hoovering up data!\n<ul>\n<li><a href=\"https:\/\/www.imore.com\/how-limit-google-ad-tracking\">How to limit Google ad tracking \u2014 www.imore.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.imore.com\/how-revoke-third-party-app-access-your-google-account\">How to revoke third-party app access to your Google account \u2014 www.imore.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.imore.com\/how-delete-or-turn-my-activity-your-google-account\">How to delete or turn off &#8216;My Activity&#8217; in your Google account \u2014 www.imore.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.imore.com\/how-delete-your-google-location-history-iphone-and-ipad\">How to delete your Google location history on iPhone and iPad \u2014 www.imore.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/www.imore.com\/amazon-alexa-what-kind-data-does-amazon-get-me\">Amazon Alexa: What kind of data does Amazon get from me? \u2014 www.imore.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<li>AMD Bugs Followup\n<ul>\n<li><a href=\"https:\/\/arstechnica.com\/gadgets\/2018\/03\/amd-promises-firmware-fixes-for-security-processor-bugs\/\">AMD promises firmware fixes for security processor bugs \u2014 arstechnica.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/23\/amd-announces-ryzen-patch-timeline-as-disclosure-controversy-rages\/\">AMD announces Ryzen patch timeline as disclosure controversy rages \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>Security Medium 1 \u2014 &#x1f1fa;&#x1f1f8; SESTA\/FOSTA &amp; CLOUD<\/h3>\n<p>In the past two weeks US legislators have been busy when it comes to regulating the internet, managing to pass two rather controversial laws with little or no debate, and without much public scrutiny.<\/p>\n<p>What these bills have in common is that they appear to be well intentioned, and appear to attempt to solve real problems, but are being harshly and strongly criticised by public interest groups like the ACLU and the EFF.<\/p>\n<h4>The CLOUD Act<\/h4>\n<p>On March 21st the CLOUD (Clarifying Lawful Overseas Use of Data) Act was signed into law. Not directly, and not after a robust debate, but as an addendum to a must-pass-or-the-government-shuts-down spending bill.<\/p>\n<p>This Microsoft&#8217;s lead lawyer&#8217;s short description of bill&#8217;s aims:<\/p>\n<pre><code>[The CLOUD Act] creates a modern legal framework for how law enforcement agencies can access data across borders\r\n<\/code><\/pre>\n<p>What that means is that it provides a mechanism for the US government to enter into agreements with foreign governments (that meet some loosely defined standards when it comes to civil liberties) which allow American law enforcement access data stored in those countries, and law enforcement agencies from those countries data stored in America.<\/p>\n<p>Some sort of international mechanism for cooperation between law enforcement is clearly needed, so the well reasoned criticisms I&#8217;ve read are not of the intent, but of the implementation. Basically, not enough safe-guards, too much discretion for the US DOJ, and potential breaches of the the 4th Amendment to the US Constitution.<\/p>\n<p>A factor which could affect the future of this law is the current Microsoft -v- DOJ case about data in Ireland that&#8217;s currently before the supreme court. When the court rules, it could impact this law, but we can&#8217;t know if or how until the ruling is released some time within the next few months.<\/p>\n<p>Something you may find surprising is that many large US tech companies, including Apple &amp; Microsoft, are in favour of the CLOUD act. The best explanation of this I&#8217;ve heard is that it boils down to <em>&#8220;it could be so much worse, let&#8217;s accept this while it&#8217;s on offer&#8221;<\/em>.<\/p>\n<h5>Links<\/h5>\n<ul>\n<li>The EFF&#8217;s criticisms of the law \u2014 <a href=\"https:\/\/www.eff.org\/deeplinks\/2018\/02\/cloud-act-dangerous-expansion-police-snooping-cross-border-data\">www.eff.org\/\u2026<\/a><\/li>\n<li>A superb article from Rene Ritchie summarising the act, the criticisms of it, the tech industry&#8217;s position on it, and the act&#8217;s impact on Apple and Apple users \u2014 <a href=\"https:\/\/www.imore.com\/cloud-act-and-apple\">www.imore.com\/\u2026<\/a><\/li>\n<\/ul>\n<h4>FOSTA\/SESTA<\/h4>\n<p>Also on March 21st, the US Senate passed FOSTA (the Fight Online Sex Trafficking Act), this final senate bill is the result of merging a previous version of FOSTA with the US House of Representatives&#8217; SESTA (Stop Enabling Sex Traffickers Act). As I write this on the 30th of March 2018 the bill is not yet a law because while it has passed both houses of congress, it hasn&#8217;t been signed into law by the President yet. Since this is a bi-partisan bill that&#8217;s almost certainly just a formality at this stage.<\/p>\n<p>In this case it&#8217;s even more obvious that this is very well intentioned legislation \u2014 who could be in favour of sex trafficking? But again, the criticism is of the execution of that good idea. The argument being made is that this law will actually have the inverse effect, making things worse for the victims of sex trafficking.<\/p>\n<p>The controversy swirls around the fact that the law re-balances so-called safe-harbour provisions for platform providers, removing many of their protections, and hence, forcing them to shut down legitimate discussions and speech out of fear of being held liable for in any way un-knowingly facilitating sex trafficking.<\/p>\n<p>Like I said, this isn&#8217;t even a law yet, but it&#8217;s already having an impact, with tech companies like Reddit and Craig&#8217;s List already starting to pro-actively censor their users.<\/p>\n<h5>Links<\/h5>\n<ul>\n<li><a href=\"https:\/\/www.eff.org\/deeplinks\/2018\/03\/how-congress-censored-internet\">How Congress Censored the Internet \u2014 www.eff.org\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/lawfareblog.com\/fosta-new-anti-sex-trafficking-legislation-may-not-end-internet-its-not-good-law-either\">FOSTA: The New Anti-Sex-Trafficking Legislation May Not End the Internet, But It\u2019s Not Good Law Either \u2014 lawfareblog.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/26\/craigslist-personals-some-subreddits-yanked-after-passage-of-fosta\/\">Craigslist personals, some subreddits yanked after passage of FOSTA \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<\/ul>\n<h3>Security Medium 2 \u2014 Apple Implements Clever Fix for the HSTS <em>&#8216;Super Cookie&#8217;<\/em><\/h3>\n<p>HSTS (HTTP Strict Transport Security) was designed to make the internet more secure, but, it came with an un-expected sting in its tail \u2014 it can be abused to track users without the use of cookies, or anything else the user can easily clear in their browser. Tracking technologies that can&#8217;t be easily cleared by users are referred to as <em>super cookies<\/em>, because they allow tracking like cookies do, but they have extra stickiness.<\/p>\n<p>The idea is simple, the first time you visit a given website, that website can send a special HTTP header in its response that tells that browser to always user HTTPS when talking to it, even if the user enters an HTTP URL. For this to work, browsers need to store all the domains that have requested they only be accessed securely, and that storage is not under the easy control over browser users. Clearing your cache or your cookies won&#8217;t make your browser forget that your bank should only be talked to securely! That seems like a feature, not a bug, right!?<\/p>\n<p>Unfortunately, once you make some information sticky, you&#8217;ve made abuse possible. Because HSTS works to an arbitrarily deep level of sub-domain nesting, attackers can get clever and set up a collection of many sub-domains, and then include links to a 1px image or something like that on each of those sub-domains in web page, add, or other kind of embed. When a browser is seen for the first time it can be randomly sent or not sent an HSTS header for each sub-domain, creating a unique pattern that the browser then stores. The pattern can be read back by seeing which HTTP URLs do and don&#8217;t get transformed into HTTPS URLs. As long as the browser remembers its HSTS data, the pattern remains, and the <em>super cookie<\/em> remains in place.<\/p>\n<p>Initially this abuse of HSTS was purely hypothetical, but the WebKit team (WebKit is the open-source core of Apple&#8217;s Safari browser) have now seen it used in the real world.<\/p>\n<p>The general consensus in the industry was that this was an un-solvable problem. Either we can have the security offered by HSTS and accept the super-cookies, or we can&#8217;t have the extra security offered by HSTS. But, some smart engineers at Apple thought differently, and they found a very cool and clever fix!<\/p>\n<p>Apple&#8217;s fix comes in two parts:<\/p>\n<ol>\n<li>HSTS headers are only accepted on the pages you are actually visiting, not on the domains used to load images etc. into those pages. I.e. if you go to <code>www.podfeet.com<\/code> and Allison&#8217;s server sends an HSTS header, the browser will accept it, but if Allison included an image from <code>www.bartb.ie<\/code> in the page you browsed to and I configured my server to send an HSTS header, Safari would ignore it. There is one small caveat to this rule, headers can be set on parent domains that are not top-level domains, so a page on <code>www.podfeet.com<\/code> could set the HSTS header for <code>podfeet.com<\/code>, but not for <code>.com<\/code>, and not for <code>subdomain.www.podfeet.com<\/code>.<\/li>\n<li>If a website is blocked from setting regular cookies due to Safari&#8217;s existing Intelligent Tracking Prevention feature, any HSTS headers it sends will be ignored. So, sites that are already in the dog house don&#8217;t get to use HSTS on Safari.<\/li>\n<\/ol>\n<p>These two simple steps preserve just about all the security benefits offered by HSTS, but they completely destroy attackers ability to abuse HSTS for tracking purposes.<\/p>\n<p>Hopefully other browser vendors follow suite, and soon!<\/p>\n<h4>Links:<\/h4>\n<ul>\n<li>A detailed but human-friendly description of how HSTS works, and how Apple&#8217;s fixes work \u2014 <a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/20\/apple-burns-the-hsts-super-cookie\/\">nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<\/ul>\n<h3>Notable Security Updates<\/h3>\n<ul>\n<li>Drupal have released a <em>&#8216;highly critical&#8217;<\/em> update to versions 7 &amp; 8 of their popular CMS. The bug allows an attacker take control of an un-patched site, and is so critical the project gave the exact time the patch would be released and told admins to stand by to patch immediately in the expectation that in-the-wild attacks would begin within hours of the patch being released. Drupal also released patches for some officially un-supported orders versions of the CMS. \u2014 <a href=\"https:\/\/www.us-cert.gov\/ncas\/current-activity\/2018\/03\/28\/Drupal-Releases-Critical-Security-Updates\">www.us-cert.gov\/\u2026<\/a><\/li>\n<li>Apple Patches just about everything:\n<ul>\n<li>iOS 11.3 \u2014 <a href=\"https:\/\/support.apple.com\/kb\/HT208693\">support.apple.com\/\u2026<\/a>\n<ul>\n<li>Includes first HomePod security update \u2014 <a href=\"https:\/\/www.macobserver.com\/news\/product-news\/homepod-software-update\/\">www.macobserver.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>macOS High Sierra 10.13.4, Security Update 2018&#8211;002 Sierra, and Security Update 2018&#8211;002 El Capitan \u2014 <a href=\"https:\/\/support.apple.com\/kb\/HT208692\">support.apple.com\/\u2026<\/a><\/li>\n<li>Safari 11.1 \u2014 <a href=\"https:\/\/support.apple.com\/kb\/HT208695\">support.apple.com\/\u2026<\/a><\/li>\n<li>watchOS 4.3 \u2014 <a href=\"https:\/\/support.apple.com\/kb\/HT208696\">support.apple.com\/\u2026<\/a><\/li>\n<li>tvOS 11.3 \u2014 <a href=\"https:\/\/support.apple.com\/kb\/HT208698\">support.apple.com\/\u2026<\/a><\/li>\n<li>iTunes 12.7.4 for Windows \u2014 <a href=\"https:\/\/support.apple.com\/kb\/HT208694\">support.apple.com\/\u2026<\/a><\/li>\n<li>iCloud for Windows 7.4 \u2014 <a href=\"https:\/\/support.apple.com\/kb\/HT208697\">support.apple.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Microsoft has released a patch for its January Meltdown patch for Windows 7 &amp; Windows Server 2018. The original patch set incorrect default permissions, actually making the OS much less secure than before it was &#8216;patched&#8217; \u2014 <a href=\"https:\/\/www.kb.cert.org\/vuls\/id\/277400\">www.kb.cert.org\/\u2026<\/a><\/li>\n<\/ul>\n<h3>Notable News<\/h3>\n<ul>\n<li>In preparation for the EU&#8217;s new GDPR (General Data Protection Regulation) which comes into force on May 25th this year, Apple have announced a number of privacy improvements: <a href=\"https:\/\/www.macobserver.com\/news\/download-apple-profile-data\/\">www.macobserver.com\/\u2026<\/a> &amp; <a href=\"https:\/\/www.imore.com\/apple-gdpr-privacy\">www.imore.com\/\u2026<\/a>\n<ul>\n<li>A new icon which will be displayed each time Apple is asking your permission to use your personal data (introduced as part of this week&#8217;s Apple OS updates)<\/li>\n<li>Data management tools to allow users to download all the personal data Apple has on them (Google &amp; Facebook have allowed this for many years now), request a correction to the personal data Apple stores on them, request your account be deactivated, and request your account be deleted. These tools are coming to EU users in May, with a world-wide roll-out later.<\/li>\n<\/ul>\n<\/li>\n<li>Security researchers find yet another lock screen bypass in iOS, Apple say a fix is on the way. (<strong>Editorial<\/strong> I continue to advise turning off Siri on the lock screen a lock should actually lock things IMO!) \u2014 <a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/22\/how-siri-leaks-your-private-iphone-messages-and-how-to-stop-her\/\">nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li>Security researchers have found a bug in the URL parser in the QR Code reader built into Apple&#8217;s iOS 11 camera app. The bug allows an attacker to craft QR codes such that the app displays one URL, but when clicked, navigates to a different URL. This kind of bug could help make a phishing attack more convincing \u2014 <a href=\"https:\/\/www.intego.com\/mac-security-blog\/ios-11s-camera-app-has-a-qr-code-vulnerability\/\">www.intego.com\/\u2026<\/a>, <a href=\"https:\/\/www.macobserver.com\/news\/iphone-qr-reader-bug\/\">www.macobserver.com\/\u2026<\/a> &amp; <a href=\"https:\/\/www.imore.com\/ios-qr-code-reader-vulnerability-could-lead-you-malicious-websites\">www.imore.com\/\u2026<\/a><\/li>\n<li>A bug in MacOS 10.13.3 writes passwords to external encrypted APFS drives to a system log file in plain text (<strong>Editorial<\/strong> if your disk is encrypted this is not a catastrophic bug, and there is a very simple work around, clear the log!) \u2014 <a href=\"https:\/\/www.intego.com\/mac-security-blog\/macos-10-13-high-sierra-stores-apfs-encrypted-disk-passwords-in-plaintext\/\">www.intego.com\/\u2026<\/a> &amp; <a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/28\/yet-another-apple-password-leak-how-to-avoid-it\/\">nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li>A security researcher has revealed that 9 years are first being informed of shortcomings in the encryption of saved passwords, FireFox still have not fixed the problem. (<strong>Editorial:<\/strong> I&#8217;d advise against using FireFox&#8217;s native password manager, at least until this is finally fixed, better to use a plugin to connect the browser to a trusted third-party password manager like OnePassword or LastPass) \u2014 <a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/20\/nine-years-on-firefoxs-master-password-is-still-insecure\/\">nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li>&#x1f1fa;&#x1f1f8; It&#8217;s come to light that US police forces are asking Google for lists of everyone who entered a given area at a given time in an attempt to narrow down their list of suspects. This has raised serious privacy concerns, and may not be legal \u2014 <a href=\"https:\/\/nypost.com\/2018\/03\/19\/cops-demand-google-phone-data-for-anyone-who-came-near-crime-scenes\/\">nypost.com\/\u2026<\/a> &amp; <a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/21\/police-ask-google-for-location-data-to-narrow-suspect-lists\/\">nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li>The FBI renews it&#8217;s push for mandatory back doors \u2014 <a href=\"https:\/\/www.nytimes.com\/2018\/03\/24\/us\/politics\/unlock-phones-encryption.html\">www.nytimes.com\/\u2026<\/a> &amp; <a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/28\/push-for-legal-mandate-to-unlock-phones-revived-by-doj\/\">nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<\/ul>\n<h3>Suggested Reading<\/h3>\n<ul>\n<li>PSAs, Tips &amp; Advice\n<ul>\n<li><a href=\"https:\/\/www.imore.com\/health-records\">Health Records: Everything you need to know about iOS 11.3&#8217;s new health feature! \u2014 www.imore.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/krebsonsecurity.com\/2018\/03\/omitting-the-o-in-com-could-be-costly\/\">Omitting the \u201co\u201d in .com Could Be Costly \u2014 krebsonsecurity.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Notable Breaches &amp; Privacy Violations\n<ul>\n<li>&#x2b50;&#xfe0f; MyFitnessPal is warning its 150M users that they have suffered a data breach (including usernames, email addresses &amp; hashed passwords, but not payment cards), and asking them to change their passwords \u2014 <a href=\"https:\/\/content.myfitnesspal.com\/security-information\/notice.html\">content.myfitnesspal.com\/\u2026<\/a> &amp; <a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/30\/150-million-myfitnesspal-accounts-compromised-heres-what-to-do\/\">nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li>Travel booking site Orbitz announced breach of 880K payment cards \u2014 <a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/22\/880000-payment-cards-affected-in-travel-company-data-breach\/\">nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/krebsonsecurity.com\/2018\/03\/san-diego-sues-experian-over-id-theft-service\/\">San Diego Sues Experian Over ID Theft Service \u2014 krebsonsecurity.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/krebsonsecurity.com\/2018\/03\/survey-americans-spent-1-4b-on-credit-freeze-fees-in-wake-of-equifax-breach\/\">Survey: Americans Spent $1.4B on Credit Freeze Fees in Wake of Equifax Breach \u2014 krebsonsecurity.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>News\n<ul>\n<li>Security researchers find a new flaw similar to one of the Spectre flaws and name it BranchScope. There are no real-world attacks against this vulnerability ATM, and it&#8217;s not clear yet if this will be a practical attack vector in the real world \u2014 <a href=\"https:\/\/arstechnica.com\/gadgets\/2018\/03\/its-not-just-spectre-researchers-reveal-more-branch-prediction-attacks\/\">arstechnica.com\/\u2026<\/a><\/li>\n<li><a href=\"http:\/\/uk.businessinsider.com\/youtube-suggested-conspiracy-videos-to-children-using-its-kids-app-2018-3\">YouTube suggested conspiracy videos to children using its Kids app &#8211; Business Insider \u2014 uk.businessinsider.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/19\/modified-blackberrys-sold-to-drug-dealers-five-indicted\/\">Modified BlackBerry phones sold to drug dealers, five indicted \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/23\/crooks-infiltrate-google-play-with-malware-lurking-in-qr-reading-utilities\/\">Crooks infiltrate Google Play with malware in QR reading utilities \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/26\/police-use-dead-mans-fingers-to-try-to-unlock-his-iphone\/\">Police use dead man\u2019s fingers to try to unlock his iPhone \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/28\/cryptocurrency-clampdown-twitter-bans-ico-ads-to-combat-scammers\/\">Cryptocurrency clampdown! Twitter bans ICO ads to combat scammers \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/28\/unmasking-monero-stripping-the-currencys-privacy-protection\/\">Unmasking Monero: stripping the currency\u2019s privacy protection \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Opinion &amp; Analysis\n<ul>\n<li>&#x2b50;&#xfe0f; (via listener Lynda) How phishing is used to generate fraudulent code signing certificates \u2014 <a href=\"https:\/\/arstechnica.com\/information-technology\/2018\/02\/counterfeit-certificates-sold-online-make-digitally-signed-malware-a-snap\/\">arstechnica.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/22\/the-password-to-your-iot-device-is-just-a-google-search-away\/\">The password to your IoT device is just a Google search away \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<li><a href=\"https:\/\/krebsonsecurity.com\/2018\/03\/who-and-what-is-coinhive\/\">Who and What Is Coinhive? \u2014 krebsonsecurity.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Propellor Beanie Teritory\n<ul>\n<li><a href=\"https:\/\/nakedsecurity.sophos.com\/2018\/03\/26\/shodan-and-passwords-sitting-in-a-tree-s-h-o-w-i-n-g\/\">Shodan and passwords sitting in a tree, S-H-O-W-I-N-G! \u2014 nakedsecurity.sophos.com\/\u2026<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Followups Cambridge Analytica &amp; Facebook Kerfuffle Followup Additional developments: It&#8217;s been revealed that Facebook scraped call and text data from Android phones for years. Technically users did opt in to the collection, but it doesn&#8217;t seem to have been informed consent based on the public reaction to the reporting: Facebook scraped call, text message data [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[147,214],"tags":[1075],"class_list":["post-14819","post","type-post","status-publish","format-standard","hentry","category-blog-posts","category-security-bits","tag-podfeet"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/14819","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/comments?post=14819"}],"version-history":[{"count":3,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/14819\/revisions"}],"predecessor-version":[{"id":14822,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/posts\/14819\/revisions\/14822"}],"wp:attachment":[{"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/media?parent=14819"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/categories?post=14819"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.podfeet.com\/blog\/wp-json\/wp\/v2\/tags?post=14819"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}