Firewalls Don't Stop Dragons Podcast
Indicators of Account Compromise
· Summarized
Key takeaways
- California Governor Newsom vetoed a crucial data privacy bill, raising concerns among privacy advocates about the power of tech companies.
- 23andMe may be on the verge of bankruptcy, with potential for DNA data sales, prompting users to consider deleting their data.
- PayPal automatically enrolled users in data-sharing practices without consent, highlighting ethical concerns around data management.
- Kaspersky's unannounced transition to UltraAV on U.S. computers raises alarms over user consent and trust.
- A significant data leak affecting millions of Americans exemplifies the need for better personal data security practices.
- Harvard researchers develop smart glasses with facial recognition technology, sparking debates on privacy ethics.
- NIST has updated outdated password guidelines, encouraging stronger password practices for enhanced digital security.
- U.S. government and Microsoft successfully seized hacker domains, reflecting ongoing efforts to combat cyber threats.
- Monitoring your accounts for signs of compromise is essential; knowing indicators can help protect your personal information.
Summary
California Privacy Legislation
The episode discusses California's recent privacy legislation, highlighting Governor Gavin Newsom's veto of a bill requiring opt-out signals for consumer data sharing. Although the governor expressed concerns regarding the bill's mandate on operating systems, many privacy advocates are disappointed, arguing that such legislation is necessary to enhance consumer privacy. Contrarily, Newsom did sign another privacy bill aimed at protecting domestic abuse survivors from being tracked via connected cars, which may lead to national changes in car data privacy.
23andMe Business Struggles
Kerry highlights significant issues facing 23andMe, including the possibility of the company going out of business. The discussion underscores concerns regarding the sale of personal DNA data, particularly given that 23andMe has reconsidered its operational strategies and might sell off its user data, which raises ethical and privacy concerns for its customers.
PayPal's Data Sharing Practices
The show reveals that PayPal has opted its users into data sharing for personalized shopping experiences without their explicit consent. Kerry discusses the potential legal implications of PayPal's approach, addressing the troubling nature of changing terms of service without notifying customers, as well as the continuing risks surrounding personal data management.
Kaspersky's Controversial Transition
Listeners learn about Kaspersky's abrupt decision to uninstall its software from U.S. computers, replacing it with an unfamiliar product, UltraAV, without asking for permission. This controversial move has raised significant consumer distrust and concerns about potential malware infections, particularly given the lack of clear communication from Kaspersky.
Major Data Breaches and Leaks
A discussion on a substantial data leak from a data broker affects over 100 million Americans, emphasizing the dire consequences of inadequate data security practices. Kerry notes that this leaves individuals vulnerable to identity theft and targeted phishing attacks, underscoring the necessity for consumers to maintain vigilance regarding their personal information.
Facial Recognition Technology in Smart Glasses
Kerry touches on a project by Harvard researchers who managed to develop smart glasses with integrated facial recognition capabilities. This alarming innovation raises privacy concerns about the potential for public surveillance and the erosion of personal anonymity in public spaces, revealing the ongoing debate over the ethical implications of emerging technologies.
Updates to NIST Password Guidelines
The National Institute of Standards and Technology (NIST) has updated its password guidelines, moving away from outdated practices such as mandatory resets and the use of specific characters. Kerry applauds these changes, emphasizing their importance in improving security practices across organizations and encouraging individuals to adapt stronger password management techniques.
U.S. Government Seizures of Russian Hacker Domains
In a positive turn of events, the U.S. government and Microsoft have seized over 100 domains used by Russian hackers for cyber espionage activities. The legal actions demonstrate a proactive approach to combating international cyber threats and protecting sensitive information, highlighting the ongoing battle against cybercriminals.
Indicators of Account Compromise
The episode concludes with key tips on identifying signs of account compromise. Kerry details various indicators, such as unfamiliar logins, changes in recovery information, and unusual activity alerts, encouraging listeners to remain vigilant in monitoring their online accounts for any suspicious behavior.
Sponsors
- CISA · CISA, the American cybersecurity and infrastructure security agency, has great resources for cybersecurity awareness.
- StaySafeOnline.org · Stay Safe Online offers important materials for individuals looking to enhance their cybersecurity knowledge.
Show notes
Sometimes it’s obvious when your accounts are hacked. Maybe your money is gone. Maybe you can no longer log in using the password you know is correct. Maybe everyone you know has gotten a scam email from you that you didn’t send. But sometimes bad guys aren’t so obvious. They may lurk around in your accounts to gather information for identity theft or in hopes of gaining access to other more lucrative accounts. I'll tell you how to find out.
In other news: CA governor vetoes opt-out signal bill but signs car privacy bill; 23andMe is in trouble and your data may be, too; PayPal opted you into data sharing without asking; Kaspersky deletes itself and installs UltraAV without asking; 100 million Americans had background data leaked; researchers add facial recognition tech to Meta's smart glasses; NIST updates password rules to with common sense changes; US & Microsoft seize 100+ web domains used by Russian hackers.
Article Links
[Ars Technica] Calif. Governor vetoes bill requiring opt-out signals for sale of user data https://arstechnica.com/tech-policy/2024/09/calif-gov-vetoes-attempt-to-require-new-privacy-option-in-browsers-and-oses/
[Teach Privacy] Bankruptcy Sale of DNA Data: From Toysmart to 23andMe https://teachprivacy.com/bankruptcy-sale-of-dna-data-from-toysmart-to-23andme/
[404 Media] Paypal Opted You Into Sharing Data Without Your Knowledge https://www.404media.co/paypal-personalized-shopping-opt-out/
[Bleeping Computer] Kaspersky deletes itself, installs UltraAV antivirus without warning https://www.bleepingcomputer.com/news/security/kaspersky-deletes-itself-installs-ultraav-antivirus-without-warning/
[Tom’s Guide] 100 million Americans just had their background check data exposed https://www.tomsguide.com/computing/online-security/100-million-americans-just-had-their-background-check-data-exposed-online-how-to-stay-safe
[404 Media] Someone Put Facial Recognition Tech onto Meta's Smart Glasses to Instantly Dox Strangers https://www.404media.co/someone-put-facial-recognition-tech-onto-metas-smart-glasses-to-instantly-dox-strangers/
[Ars Technica] NIST proposes barring some of the most nonsensical password rules https://arstechnica.com/security/2024/09/nist-proposes-barring-some-of-the-most-nonsensical-password-rules/
[The Record] California passes car data privacy law to protect domestic abuse survivors https://therecord.media/california-car-data-privacy-law-domestic-abuse-tracking
[Semafor] US, Microsoft seize more than 100 websites used by Russian hackers https://www.semafor.com/article/10/03/2024/us-microsoft-seize-more-than-100-websites-used-by-russian-hackers
Tip of the Week: Indicators of Account Compromise: https://firewallsdontstopdragons.com/indicators-of-account-compromise/
Further Info
Help me reach more people! https://fdsd.me/awareness2
Treasure Chest promotion: https://firewallsdontstopdragons.com/treasure-coin-promo/
How to enable Global Privacy Control: https://firewallsdontstopdragons.com/how-to-enable-global-privacy-control/
My article on removing your data from the web: https://firewallsdontstopdragons.com/osint-remediation/
CISA Cybersecurity Awareness Month resources: https://www.cisa.gov/resources-tools/resources/secure-our-world-resources-cybersecurity-awareness-month-2024-toolkit
Stay Safe Online CAM site: https://staysafeonline.org/programs/cybersecurity-awareness-month/
Send me your questions! https://fdsd.me/qna
Check out my book, Firewalls Don’t Stop Dragons: https://fdsd.me/book
Subscribe to the newsletter: https://fdsd.me/newsletter
Become a patron! https://www.patreon.com/FirewallsDontStopDragons
Get your Firewalls Don’t Stop Dragons Merch! https://fdsd.me/merch
Give the gift of privacy and security: https://fdsd.me/coupons
Support our mission! https://fdsd.me/support
Generate secure passphrases! https://d20key.com/#/
Table of Contents
Use these timestamps to jump to a particular section of the show.
0:01:12: Cybersecurity Awareness Month!
0:01:51: Update Apple software
0:03:21: News rundown
0:05:41: CA Governor vetoes bill requiring opt-out signals for sale of user data
0:11:51: Potential Bankruptcy Sale of DNA Data from 23andMe
0:17:22: Paypal Opted You Into Sharing Data Without Your Knowledge
0:22:01: Kaspersky deletes itself, installs UltraAV antivirus without warning
0:28:14: 100 million Americans just had their background check data exposed
0:32:13: Someone Put Facial Recognition Tech onto Meta's Smart Glasses to Instantly Dox Strangers
0:36:33: NIST proposes barring some of the most nonsensical password rules
0:42:21: California passes car data privacy law to protect domestic abuse survivors
0:45:36: US, Microsoft seize more than 100 websites used by Russian hackers
0:47:49: Tip of the Week
1:04:13: promoting the 400th episode
1:05:42: Patron perks!
1:09:08: Looking ahead
Follow this show on AudioBrevity and new episodes get summarized for you. Create a free account