Tag Archive for: Potentially

Mobile app developers potentially expose personal data of 100 million Android users


After examining 23 Android applications, Check Point Research noticed mobile app developers potentially exposed the personal data of over 100 million users through a variety of misconfigurations of third party cloud services. 

Personal data included emails, chat messages, location, passwords and photos, which, in the hands of malicious actors could lead to fraud, identity-theft and service swipes.

CPR discovered publicly available sensitive data from real-time databases in 13 Android applications, with the number of downloads that each app has ranging from 10,000 to 10 million.

It found push notification and cloud storage keys embedded in a number of Android applications themselves. 

Modern cloud-based solutions have become the new standard in the mobile application development world. Services such as cloud-based storage, real-time databases, notification management, analytics, and more are simply a click away from being integrated into applications. Yet, CPR says developers often overlook the security aspect of these services, their configuration, and their content.

CPR recently discovered that in the last few months, many application developers have left their data and millions of users’ private information exposed by not following best practices when configuring and integrating third party cloud-services into their applications. The misconfiguration put users’ personal data and developers’ internal resources, such as access to update mechanisms, storage and more, at risk, it says.

Misconfiguring Real-Time Databases

Real-time databases allow application developers to store data on the cloud, making sure it is synchronised in real-time to every connected client. This service solves one of the most encountered problems in application development, while making sure that the database is supported for all client platforms. 

However, what happens if the developers behind the application do not configure their real-time database with a simple and basic feature like authentication?

“This misconfiguration of real-time databases is not new, and continues to be widely common, affecting millions of users,” CPR says. 

“All CPR researchers had to do was attempt to access…

Source…

Secure MCUs Market 2020: Potential Growth, Challenges, and Know the Companies List Could Potentially Benefit or Loose out From the Impact of COVID-19 | Key Players: NXP Semiconductors, Infineon, STMicroelectronics, Beijing HuaDa ZhiBao Electronic System, Renesas, etc.


A perfect mix of quantitative & qualitative Secure MCUs market information highlighting developments, industry challenges that competitors are facing along with gaps and opportunities available and would trend in Secure MCUs market. The study bridges the historical data from 2014 to 2019 and estimated until 2025. 

The Secure MCUs Market report also provides the market impact and new opportunities created due to the COVID19/CORONA Virus Catastrophe The total market is further divided by company, by country, and by application/types for the competitive landscape analysis. The report then estimates 2020-2025 market development trends of Secure MCUs Industry.

Download Free Sample PDF along with few company profiles
https://inforgrowth.com/sample-request/6386970/secure-mcus-market

The Top players are NXP Semiconductors, Infineon, STMicroelectronics, Beijing HuaDa ZhiBao Electronic System, Renesas, Samsung, Inside Secure.

Market Segmentation:

Secure MCUs Market is analyzed by types like Personal Security, Embedded Security

On the basis of the end users/applications, Mobile Security, Automotive, Banking, Transport, PayTV & ID, Wearables, Security in IoT Connectivity, Others

Downlaod Sample ToC to understand the CORONA Virus/COVID19 impact and be smart in redefining business strategies.
https://inforgrowth.com/CovidImpact-Request/6386970/secure-mcus-market

Secure

Be the first to knock the door showing the potential that Secure MCUs market is holding in it. Uncover the Gaps and Opportunities to derive the most relevant insights from our research document to gain market size.

A major chunk of this Global Secure MCUs Market research report is talking about some significant approaches for enhancing the performance of the companies. Marketing strategies and different channels have been listed here. Collectively, it gives more focus on changing rules, regulations, and policies of governments. It will help to both established and new startups of the market.

The study objectives of this report are:
To analyze global Secure MCUs status, future forecast, growth opportunity, key market, and key players.
To present the Secure MCUs development in the United States, Europe, and China.
To…

Source…

Major hospital system hit with cyberattack, potentially largest in U.S. history – NBC News

  1. Major hospital system hit with cyberattack, potentially largest in U.S. history  NBC News
  2. Health care provider Universal Health Services hit with cyberattack  USA TODAY
  3. Universal Health Services offline due to ‘IT security issue’  ETCIO.com
  4. Hospital Chain Targeted in Large-Scale Cyber Attack  Bay News 9
  5. Hospital company with local sites says its computer networks knocked offline  wtkr.com
  6. View Full Coverage on read more

“computer security news” – read more

PayPal Blocks Purchases Of Tardigrade Merchandise For Potentially Violating US Sanctions Laws

Moderation at scale is impossible. And yet, you’d still hope we’d get better moderation than this, despite all the problems inherent in policing millions of transactions.

Archie McPhee — seller of all things weird and wonderful — recently tried promoting its “tardigrade” line of goods only to find out PayPal users couldn’t purchase them. Tardigrades are the official name for microscopic creatures known colloquially as “water bears.” Harmless enough, except PayPal blocked the transaction and sent this unhelpful response:

If you can’t read/see the tweet and the screenshot, here’s what it says:

Just an FYI that @PayPal is currently blocking all transactions containing the word “tardigrade” in the product name or description. We’ve contacted them and they told us we should just stop using the word tardigrade.

And PayPal’s response:

Every transaction that goes through our system, is reviewed by our internal security team. Certain words can trigger our security system. Unfortunately, this cannot be overridden. I would advise you to change the wording on your website to prevent this from happening.

PayPal’s size demands the use of automated moderation. But this outcome seems inexplicable. It says the “internal security team” manually reviewed the block… and decided to keep it in place anyway. What’s the point of having a “security team” if they can’t override the algorithm’s decision?

Then there’s the question as to why “tardigrade” is blocked in the first place. It’s the official name for a particularly hardy micro-animal found all over the world. Early speculation centered on the Scunthorpe Problem, suggesting PayPal blocks transactions involving forms of the word “retarded.”

But it appears to be even more ridiculous than that. Tim Ellis at GeekWire received this explanation from PayPal:

A PayPal representative put the blame on the US government’s Office of Foreign Assets Control (OFAC) sanctions, which contain an entry for an industrial supply company called “Tardigrade Limited” located in the country of Cyprus. According to PayPal, the word “tardigrade” triggered a manual review process because their system determined that the payments “may potentially violate US sanction laws.”

Customers have a Balkan arms dealer to blame for their inability to purchase tardigrade goods.

Slobodan Tesic (Tesic) was identified in the annex of E.O. 13818 on December 21, 2017. At the time of his designation, Tesic was among the biggest dealers of arms and munitions in the Balkans, spending nearly a decade on the United Nations (UN) Travel Ban List for violating UN sanctions against arms exports to Liberia.

[…]

Tesic also utilized Cyprus-based Tardigrade Limited (Tardigrade) to conduct business in third-party countries, particularly Arab and African countries. Tesic has also used his Serbian companies to sign contracts with Tardigrade before selling the goods to a final buyer.

So, “tardigrade” is flagged by the system as indicative of sanctions violations. But there’s that term again: “manual review.” Is it impossible for reviewers to distinguish between arms sales through third parties and these?

Now, it could be the manual review team didn’t want to end up on the wrong side of sanctions and felt safer blocking transactions than possibly allowing an arms dealer to launder money through the sale of adorable water bear products. Or it could be the manual “review” consists of scrolling through a list of flagged items as quickly as possible and hitting the “approve all” button. Whatever it is, it ain’t working. And Archie McPhee isn’t the first retailer to run into this problem. Two months ago, Two Photon Art noted it had to rename its Tardigrade pin to “Water Bear Enamel Pin” to allow PayPal users to purchase it.

Erring on the side of caution seems like the smart thing to do. But when the term “manual review” accompanies “automated process,” you’d think manual reviewers would see these errors for what they are, rather than allow the blocking to continue. It appears PayPal is doing a little more manual review for tardigrade-related purchases now that it’s gone a bit viral, with customers experiencing delays rather than being hit with warnings their purchases have violated PayPal policies.

The upshot is stuff like this will only become more common as time goes on. The more pressure that’s placed on tech companies to aggressively police content, the greater the chance harmless content will be rendered inaccessible. It’s not that companies shouldn’t make efforts to keep their sites free of illegal content and whatever the companies would rather not see on their sites, but automated moderation will always create issues like these. And there just aren’t enough manual reviewers available to clean up algorithmic mistakes.

Techdirt.