Hackers Corrupt Data For Cloud-Based Medical Marijuana System

Long-time Slashdot reader t0qer writes:

I’m the IT director at a medical marijuana dispensary. Last week the point of sales system we were using was hacked… What scares me about this breach is, I have about 30,000 patients in my database alone. If t…

Long-time Slashdot reader t0qer writes:

I’m the IT director at a medical marijuana dispensary. Last week the point of sales system we were using was hacked… What scares me about this breach is, I have about 30,000 patients in my database alone. If this company has 1,000 more customers like me, even half of that is still 15 million people on a list of people that “Smoke pot”…
” No patient, consumer, or client data was ever extracted or viewed,” the company’s data directory has said. “The forensic analysis proves that. The data was encrypted — so it couldn’t have been viewed — and it was never extracted, so nobody has it and could attempt decryption.” They’re saying it was a “targeted” attack meant to corrupt the data rather than retrieve it, and they’re “reconstructing historical data” from backups, though their web site adds that their backup sites were also targeted.
“In response to this attack, all client sites have been migrated to a new, more secure environment,” the company’s CEO announced on YouTube Saturday, adding that “Keeping our client’s data secure has always been our top priority.” Last week one industry publication had reported that the outage “has sent 1,000 marijuana retailers in 23 states scrambling to handle everything from sales and inventory management to regulatory compliance issues.”

Read more of this story at Slashdot.

Tor Onion Browser’s Creator Explains Free Version For iOS

The free iOS version of the Tor browser “sparked a tidal wave of interest” after its release in December, according to Silicon.co. Mickeycaskill writes: The cost has been scrapped due to developer Mike Tigas’ worries that the price was limiting access …

The free iOS version of the Tor browser “sparked a tidal wave of interest” after its release in December, according to Silicon.co. Mickeycaskill writes: The cost has been scrapped due to developer Mike Tigas’ worries that the price was limiting access to anonymous browsing for those who need it most. “Given recent events, many believe it’s more important than ever to exercise and support freedom of speech, privacy rights, and digital security,” Tigas wrote in a blog post. “I think now is as good a time as ever to make Onion Browser more accessible to everyone.”

“I’m still a little terrified that I’ve made this change,” Tigas adds. For four years the Tor Onion browser was available on the Apple App Store for $0.99, the lowest non-free price allowed by Apple, providing a “reliable” income to Tigas which helped him move to New York for a new job while allowing him “the economic freedom to continue working on side projects that have a positive impact in the world.” Tigas also writes that “there’s now a Patreon page and other ways to support the project.”

Last month the Tor Project also released the first alpha version of the sandboxed Tor Browser.

Read more of this story at Slashdot.

Switzerland Agrees To Its Own New Data Sharing Pact With the US

Mickeycaskill quotes a report from Silicon.co.uk: Switzerland has agreed its own new data transfer agreement with the United States, basing the framework on the deal struck by the European Union (EU) following the invalidation of Safe Harbour. The prev…

Mickeycaskill quotes a report from Silicon.co.uk: Switzerland has agreed its own new data transfer agreement with the United States, basing the framework on the deal struck by the European Union (EU) following the invalidation of Safe Harbour. The previous arrangement was invalidated because of concerns about U.S. mass surveillance but Switzerland says the new Swiss-U.S. Privacy Shield will allow Swiss companies to transfer customer data without the need for additional contractual guarantees. The Swiss Federal Council, a seven member executive council that is effectively the head of government in Switzerland, claim citizens will benefit from additional protections and the ability to contact an ombudsman about data issues. Although not part of the EU, Switzerland is a member of the European Economic Area (EEA) and has several bilateral agreements with the EU that sees it adopt many of the bigger bloc’s policies. The Federal Council says the alignment between the EU and the Swiss transatlantic data sharing partnerships is good news for multinational organizations.

Read more of this story at Slashdot.

Switzerland Agrees To Its Own New Data Sharing Pact With the US

Mickeycaskill quotes a report from Silicon.co.uk: Switzerland has agreed its own new data transfer agreement with the United States, basing the framework on the deal struck by the European Union (EU) following the invalidation of Safe Harbour. The prev…

Mickeycaskill quotes a report from Silicon.co.uk: Switzerland has agreed its own new data transfer agreement with the United States, basing the framework on the deal struck by the European Union (EU) following the invalidation of Safe Harbour. The previous arrangement was invalidated because of concerns about U.S. mass surveillance but Switzerland says the new Swiss-U.S. Privacy Shield will allow Swiss companies to transfer customer data without the need for additional contractual guarantees. The Swiss Federal Council, a seven member executive council that is effectively the head of government in Switzerland, claim citizens will benefit from additional protections and the ability to contact an ombudsman about data issues. Although not part of the EU, Switzerland is a member of the European Economic Area (EEA) and has several bilateral agreements with the EU that sees it adopt many of the bigger bloc’s policies. The Federal Council says the alignment between the EU and the Swiss transatlantic data sharing partnerships is good news for multinational organizations.

Read more of this story at Slashdot.

Fingerprinting Methods Identify Users Across Different Browsers On the Same PC

An anonymous reader quotes a report from BleepingComputer: A team of researchers from universities across the U.S. has identified different fingerprinting techniques that can track users when they use different browsers installed on the same machine. N…

An anonymous reader quotes a report from BleepingComputer: A team of researchers from universities across the U.S. has identified different fingerprinting techniques that can track users when they use different browsers installed on the same machine. Named “cross-browser fingerprinting” (CBF), this practice relies on new technologies added to web browsers in recent years, some of which had been previously considered unreliable for cross-browser tracking and only used for single browser fingerprinting. These new techniques rely on making browsers carry out operations that use the underlying hardware components to process the desired data. For example, making a browser apply an image to the side of a 3D cube in WebGL provides a similar response in hardware parameters for all browsers. This is because the GPU card is the one carrying out this operation and not the browser software. According to the three-man research team led by Assistant Professor Yinzhi Cao from the Computer Science and Engineering Department at Lehigh University, the following browser features could be (ab)used for cross-browser fingerprinting operations: [Screen Resolution, Number of CPU Virtual Cores, AudioContext, List of Fonts, Line, Curve, and Anti-Aliasing, Vertex Shader, Fragment Shader, Transparency via Alpha Channel, Installed Writing Scripts (Languages), Modeling and Multiple Models, Lighting and Shadow Mapping, Camera and Clipping Planes.] Researchers used all these techniques together to test how many users they would be able to pin to the same computer. For tests, researchers used browsers such as Chrome, Firefox, Edge, IE, Opera, Safari, Maxthon, UC Browser, and Coconut. Results showed that CBF techniques were able to correctly identify 99.24% of all test users. Previous research methods achieved only a 90.84% result.

Read more of this story at Slashdot.

Fingerprinting Methods Identify Users Across Different Browsers On the Same PC

An anonymous reader quotes a report from BleepingComputer: A team of researchers from universities across the U.S. has identified different fingerprinting techniques that can track users when they use different browsers installed on the same machine. N…

An anonymous reader quotes a report from BleepingComputer: A team of researchers from universities across the U.S. has identified different fingerprinting techniques that can track users when they use different browsers installed on the same machine. Named “cross-browser fingerprinting” (CBF), this practice relies on new technologies added to web browsers in recent years, some of which had been previously considered unreliable for cross-browser tracking and only used for single browser fingerprinting. These new techniques rely on making browsers carry out operations that use the underlying hardware components to process the desired data. For example, making a browser apply an image to the side of a 3D cube in WebGL provides a similar response in hardware parameters for all browsers. This is because the GPU card is the one carrying out this operation and not the browser software. According to the three-man research team led by Assistant Professor Yinzhi Cao from the Computer Science and Engineering Department at Lehigh University, the following browser features could be (ab)used for cross-browser fingerprinting operations: [Screen Resolution, Number of CPU Virtual Cores, AudioContext, List of Fonts, Line, Curve, and Anti-Aliasing, Vertex Shader, Fragment Shader, Transparency via Alpha Channel, Installed Writing Scripts (Languages), Modeling and Multiple Models, Lighting and Shadow Mapping, Camera and Clipping Planes.] Researchers used all these techniques together to test how many users they would be able to pin to the same computer. For tests, researchers used browsers such as Chrome, Firefox, Edge, IE, Opera, Safari, Maxthon, UC Browser, and Coconut. Results showed that CBF techniques were able to correctly identify 99.24% of all test users. Previous research methods achieved only a 90.84% result.

Read more of this story at Slashdot.

Japan Researchers Warn of Fingerprint Theft From ‘Peace’ Sign

Tulsa_Time quotes a report from Phys.Org: Could flashing the “peace” sign in photos lead to fingerprint data being stolen? Research by a team at Japan’s National Institute of Informatics (NII) says so, raising alarm bells over the popular two-fingered …

Tulsa_Time quotes a report from Phys.Org: Could flashing the “peace” sign in photos lead to fingerprint data being stolen? Research by a team at Japan’s National Institute of Informatics (NII) says so, raising alarm bells over the popular two-fingered pose. Fingerprint recognition technology is becoming widely available to verify identities, such as when logging on to smartphones, tablets and laptop computers. But the proliferation of mobile devices with high-quality cameras and social media sites where photographs can be easily posted is raising the risk of personal information being leaked, reports said. The NII researchers were able to copy fingerprints based on photos taken by a digital camera three meters (nine feet) away from the subject.

Read more of this story at Slashdot.

Why You Shouldn’t Trust Geek Squad

An anonymous reader quotes a report from Network World: The Orange County Weekly reports that Best Buy’s “Geek Squad” repair technicians routinely search devices brought in for repair for files that could earn them $500 reward as FBI informants. This r…

An anonymous reader quotes a report from Network World: The Orange County Weekly reports that Best Buy’s “Geek Squad” repair technicians routinely search devices brought in for repair for files that could earn them $500 reward as FBI informants. This revelation came out in a court case, United States of America v. Mark A. Rettenmaier. Rettenmaier is a prominent Orange County physician and surgeon who took his laptop to the Mission Viejo Best Buy in November 2011 after he was unable to start it. According to court records, Geek Squad technician John “Trey” Westphal found an image of “a fully nude, white prepubescent female on her hands and knees on a bed, with a brown choker-type collar around her neck.” Westphal notified his boss, who was also an FBI informant, who alerted another FBI informant — as well as the FBI itself. The FBI has pretty much guaranteed the case will be thrown out by its behavior, this illegal search aside. According to Rettenmaier’s defense attorney, agents conducted two additional searches of the computer without obtaining necessary warrants, lied to trick a federal magistrate judge into authorizing a search warrant for his home, then tried to cover up their misdeeds by initially hiding records. Plus, the file was found in the unallocated “trash” space, meaning it could only be retrieved by “carving” with sophisticated forensics tools. Carving (or file carving) is defined as searching for files or other kinds of objects based on content, rather than on metadata. It’s used to recover old files that have been deleted or damaged. To prove child pornography, you have to prove the possessor knew what he had was indeed child porn. There has been a court case where files found on unallocated space did not constitute knowing possession because it’s impossible to determine who put the file there and how, since it’s not accessible to the user under normal circumstances.

Read more of this story at Slashdot.

WhatsApp, Gmail Roped Into Tougher EU Privacy Proposal

Online messaging and email services such as WhatsApp, iMessage and Gmail will face tough new rules on how they can track users under a proposal presented by the European Union executive on Tuesday. From a report: The web players will have to guarantee …

Online messaging and email services such as WhatsApp, iMessage and Gmail will face tough new rules on how they can track users under a proposal presented by the European Union executive on Tuesday. From a report: The web players will have to guarantee the confidentiality of their customers’ conversations and ask for their consent before tracking them online to serve them personalized ads. The proposal by the European Commission extends some rules that now only apply to telecom operators to web companies offering calls and messages using the internet, known as “Over-The-Top” (OTT) services, seeking to close a perceived regulatory gap between the telecoms industry and mainly U.S. Internet giants such as Facebook, Google and Microsoft.

Read more of this story at Slashdot.

Lawyer Rewrites Instagram’s Privacy Policy So Kids and Parents Can Have a Meaningful Talk About Privacy

Kids, of age between 12 and 15, are increasingly joining Facebook’s Instagram service, but according to a research, they likely don’t even understand what they are signing up for. Jenny Afia, a privacy law expert at Schillings, a UK-based law firm, rew…

Kids, of age between 12 and 15, are increasingly joining Facebook’s Instagram service, but according to a research, they likely don’t even understand what they are signing up for. Jenny Afia, a privacy law expert at Schillings, a UK-based law firm, rewrote Instagram’s terms of service in child-friendly language, so that not only the kids but their parents are able to understand what things are at stake. Highlighted are the changes the lawyer has made: Officially you own any original pictures and videos you post, but we are allowed to use them, and we can let others use them as well, anywhere around the world. Other people might pay us to use them and we will not pay you for that. […] We may keep, use and share your personal information with companies connected with Instagram. This information includes your name, email address, school, where you live, pictures, phone number, your likes and dislikes, where you go, who your friends are, how often you use Instagram, and any other personal information we find such as your birthday or who you are chatting with, including in private messages (DMs). […] We might send you adverts connected to your interests which we are monitoring. You cannot stop us doing this and it will not always be obvious that it is an advert.

Read more of this story at Slashdot.