By Owais Sultan
The Internet offers a convenient platform for sharing data, but it also brings the risk of data leaks.…
This is a post from HackRead.com Read the original post: Safe Data Sharing Practices: How to Avoid Data Leaks

The Internet offers a convenient platform for sharing data, but it also brings the risk of data leaks. A data leak occurs when sensitive information is accidentally exposed, differing from a data breach, which usually stems from a deliberate cyberattack.

To prevent data leaks, companies can implement secure practices to safeguard their information. Explore further to discover effective measures your organization can take to ensure data security.

****Why is Data Leak Prevention Important?****

Data leaks are a focus for cybercriminals. Many of them monitor accounts, waiting for a leak to occur. Accidental exposure can provide access to financial information, trade secrets, personal identification information, and private records.

When a malicious party accesses sensitive information, there’s no saying what they will do with it. They may visit dark web forums and put the information up for sale or publish it freely. Or they may publish stolen data on dark websites or ransomware blogs to make the information public.

****What are Common Data Leak Causes?****

Data leaks can happen for various reasons. Understanding common data leak causes can help address the issue. Here are some issues to be aware of:

*   **Misconfigured software settings:** Security settings that are either not implemented or deployed with errors can cause security gaps that leave data unprotected. 
*   **Software vulnerabilities:** Unpatched security makes it easy for sensitive data to slip through the cracks. 
*   **Weak passwords:** Weak passwords make private information vulnerable to cybercrime attacks.  Multi-factor authentication can keep systems protected. 
*   **Insider threats:** Excessive privileges increase the risk of internal threats. It’s scary to think about, but even a trusted employee can steal data from a company’s system. 
*   **Social engineering:** Social engineering is the use of deception or manipulation to coerce individuals into divulging confidential information. 
*   **Physical theft:** An increased focus on cybersecurity makes it difficult to account for devices being lost or stolen. Companies must keep hardware protected. 
*   **Spear-phishing:** Spear-phishing occurs when a cybercriminal sends out an email requesting financial or sensitive information. These emails often seem legitimate and innocent, but they can have serious implications if sensitive information is transmitted. 
*   **Botnets:** Botnets are a network of private computers infected with malicious software. They can take over your computer and access important data. 
*   **Personal Mobile Devices:** Employees’ mobile devices may store sensitive data that can be easily accessed by malicious users. 
*   **Remote Work Environments:** Remote work environments mean more data is sent over the internet increasing the risk that it will fall into the wrong hands. 

****Best Practices for Avoiding Data Leaks********Evaluate Third-Party Risk****

Companies risk data leaks when they pass sensitive information on to third-party vendors. Organizations can increase security by ensuring their vendors are compliant with regulatory standards like HIPAA, GDPR, and PCI-DSS. Risk questionnaires can be used to assess potential threats when partnering with new vendors. 

Expanding organizations may find it difficult to maintain risk management regulations for third-party companies that may also experience growth spurts. Scaling vendor risk management as a managed service could streamline the process. Companies can achieve this goal by leveraging automation and protecting their business if a data leak occurs.

****Limit Access to Sensitive Data****

Organizations must identify sensitive data and classify it with strict security policies. They should restrict privileges to ensure the data is accessed only by those who need it. 

Systems must be implemented to evaluate permissions and ensure access isn’t granted to unauthorized parties. The data should then be categorized into different levels of sensitivity. Only trusted staff members should have access to highly sensitive data. 

The technology may also identify malicious behaviour within the system. 

**Enforce Network Access Control**

Companies must monitor network access to protect data from unauthorized users. They must review the communication coming into the network to ensure it’s coming from trusted sources. They must integrate data leak prevention solutions to ensure information isn’t compromised when a leak occurs. 

A Network Access Control (NAC) solution may help organizations keep data safe. It denies access to noncompliant devices, places them in a quarantined area, or limits their privileges to prevent infections. 

****Data Encryption****

Data encryption is a valuable anti-data leak tool. It encrypts data so it can only be read by people with access privileges. Cybercriminals will be unable to decipher sensitive data. 

Portable encryption is recommended because it ensures that data will be automatically encrypted if it leaves the confines of your network. 

However, advanced cybercriminals may be able to translate data encryption. Therefore, it should be combined with other anti-leak strategies to ensure information remains protected. 

****Secure Endpoints****

Endpoints are physical devices that connect to a network. Examples include mobile devices, desktop computers, servers, embedded devices, IoT devices, and virtual machines. The increased adoption of remote work environments has made these endpoints harder to secure. 

Organizations can protect endpoints with extended endpoint security. Employees with company iPhones should use Security Recommendations which notify them when their information has been compromised by a data leak. 

Firewalls and VPNs also protect endpoints, but many cybercriminals have learned to bypass them. They should be combined with additional security measures for optimal efficiency. 

****Utilize Data Loss Prevention (DLP) Software****

Data loss prevention applies to data leak prevention. It ensures sensitive data is not lost, misused, or exposed to unauthorized parties. A DLP program performs the following functions:

*   Identifies Data: AI may be used to identify data and streamline processes. 
*   Secures Data: DLP software may be deployed at the end of the network to ensure data transfers align with secure data policies.  
*   Secures Endpoints: Endpoint DLP monitors real-time user behaviour to ensure transfers occur between authorized parties. 
*   Protect Archived Data: The software uses regulatory compliance, access control, and encryption to protect archived data. 
*   Monitors Active Data: DLP tools will monitor data and flag suspicious behaviour. 
*   Detects Data Leaks: Data leak technology will scan for data exposures for fast remediation if a breach occurs. 

****Employee Awareness Training** **

Employees must be aware of the best anti-leak practices, as they are often susceptible to social engineering tactics, such as falling for phishing emails and similar scams.

To prevent employee-related data leaks, organizations should incorporate cybersecurity training into their onboarding process and provide ongoing training to keep workers informed about the latest cybersecurity trends. This approach ensures that networks remain secure from the ground up.

While data leaks may not constitute a direct attack, they can be just as damaging when sensitive information falls into the wrong hands. Implementing employee training, Data Loss Prevention (DLP) software, data encryption, access control measures, secure endpoints, and mitigating third-party risks are crucial steps to keep your system protected.

Which strategies do you use to ensure your company is safe? 

****RELATED ARTICLES****

1.  **Exploring Data Privacy and Security in B2B Gaming Data**
2.  **Approaching Complex Data Security for Small Businesses**
3.  **Protecting Company Files: Secure Strategies for Data Safety**
4.  **LoanDepot Ransomware Attack – Data Breach; 17M Impacted**
5.  **Cyqur Launches Data Encryption, Fragmentation Web Extension**

Safe Data Sharing Practices: How to Avoid Data Leaks

By Uzair Amir
Made available under an open-source license after rigorous academic research, Plasma Next allows anyone to fork the code and launch the network.
This is a post from HackRead.com Read the original post: INTMAX Launches Plasma Next to Scale Ethereum with Stateless Layer

INTMAX, an innovative Layer 2 zkRollup that uses stateless architecture, has officially launched Plasma Next on the mainnet α (Alpha). INTMAX Co-founder and long-time Plasma researcher Leona Hioki unveiled it at ETH Denver. Based on the foundational principles of the Plasma framework, it scales with a constant cost per block regardless of the number of users, and achieves the scalability that the original Plasma aimed for while retaining the same security assumptions as zkRollups.

Plasma Next represents a paradigm shift in how blockchain networks can achieve scalability without compromising on decentralization. By leveraging the power of bulk-token-transfer and Merkle Trees, and integrating ZKP-TLC for conditional payments, Plasma Next introduces a system with the constant state growth per block. This innovative approach eliminates the need for users to provide individual liquidity or remain constantly online, thereby enhancing the user experience and network efficiency.

INTMAX Co-founder Leona Hioki said, “_INTMAX_ _goes beyond just presenting theoretical or conceptual papers. It includes the release of code and the network as well. Made available under an open-source license, it allows anyone to fork the code and launch the network.”_

One of the most important parts of Plasma Next is its stateless architecture which, according to a16z researchers, is challenging to achieve because validators would need to store only a minimal, constant-size state. Despite significant research and efforts to reduce the storage burden for validators, a16z concludes that a completely stateless blockchain is impractical. However, Plasma Next can scale at a fixed cost per block, regardless of the number of users. The solution theoretically becomes a pseudo solution to the impossibility of statelessness, as proven by a16z.

Stateless solutions are where instead of nodes or validators holding the data, users manage their own data. While the idea of users managing their own data may sound complicated, most of it would be automated along with encrypted backups.

Plasma, a once-prominent Ethereum layer-2 scaling solution conceptualized by Vitalik Buterin and Joseph Poon in 2017, was intended to help bring Visa-level transaction volumes to Ethereum. Plasma networks allow all data and computation, except for deposits, withdrawals and Merkle roots, to be kept off-chain. This opens the door to very large scalability gains that are not bottlenecked by on-chain data availability.

However, Plasma had significant issues with user experience and online requirements such as:

1.  Users had to wait an entire challenge period before withdrawing
2.  Users had to monitor transactions on the Plasma chain

For these reasons, Plasma had been superseded by Rollups. The newly launched Plasma Next is a hybrid between Plasma and Rollups, combining the strengths of both to enhance security and scalability. It incorporates sophisticated zero-knowledge proofs (ZKPs) to ensure transactions are processed with unparalleled privacy and security.

Plasma Next represents a groundbreaking evolution, promising to redefine blockchain scalability and privacy for the digital age. By addressing the need for constant online presence—a significant barrier to user adoption—Plasma Next marks a significant leap forward. It enables constant state growth per block without requiring individual liquidity preparations, thereby enhancing on-chain privacy and simplifying blockchain transactions.

****About** **INTMAX****

INTMAX is the Stateless Ethereum Layer built for mass adoption. It is an innovative Layer 2 zkRollup that uses stateless architecture to offer a highly efficient, secure, and scalable solution for blockchain applications. INTMAX provides a ready-to-use solution to empower any applications and services with instant, the most secure, and near-zero cost crypto transactions.

**Contact:** Sergei Medvedev, \[email protected\]

INTMAX Launches Plasma Next to Scale Ethereum with Stateless Layer

By Deeba Ahmed
Brand Hijacking Alert: Guardio Reveals Malicious Actors Using Trusted Brands for Phishing.
This is a post from HackRead.com Read the original post: ResurrecAds Attack Hijacks Brand Names, Spreads Spam Via ‘SubdoMailing’

Hackers hijacked subdomains of major brands like eBay and CBS to send spam emails disguised as legitimate messages – Learn how to protect yourself from these deceptive phishing attempts.

Guardio Labs is monitoring a campaign called SubdoMailing, which has been circulating spam and phishing emails since September 2022. The campaign, attributed to a threat actor called ResurrecAds, manipulates the digital advertising ecosystem by resuscitating dead domains associated with big brands – A malicious practice also known as **Brand Hijacking**.

The scam was detected after Guardio Labs’ email protection systems discovered unusual patterns in email metadata mainly related to SMTP servers that are authenticated as legitimate senders. This led Guardio to launch an investigation into the SMTP protocol, domain hunting, and **DNS scanning tools**. 

The ResurrecAds incident mirrors a prior case where, in November 2022, cybersecurity researchers at Cyjax **uncovered** 42,000 phishing domains posing as well-known brands, distributing malware for ad revenue.

The team discovered an unprecedented subdomain hijacking operation, where thousands of hijacked sub-domains were used to send spammy and malicious emails, falsely authorized under international brands. The campaign uses the trust in these domains to circulate spam and phishing emails, **bypassing security measures**.

The emails can also circumvent the Sender Policy Framework (SPF), an email authentication method, and pass DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC) checks to prevent messages from being marked as spam.

Guardio researchers **discovered** over 8,000 domains from renowned brands/institutions (MSN, VMware, McAfee, The Economist, Cornell University, CBS, Marvel, eBay). Researchers dubbed this activity “SubdoMailing,” which exploits users’ trust to circulate spammy phishing emails.

They called it a classic subdomain hijacking scheme because it involves scanning and enumerating domains for forgotten subdomains, registering them, and using SPF records to send malicious emails. This can lead to unauthorized access to SMTP servers and valuable assets for hackers.

The sample email researchers analyzed was disguised as an image to bypass spam filters, trigger click-redirects through various domains, targeting device type and location to display content tailored to maximize profit. This unique scheme raises questions about how it bypasses authentication and security checks with major email providers.

The evidence suggests a single threat actor, “ResurrecAds,” is responsible for a large-scale operation scanning the internet for “vulnerable domains, identifying opportunities, purchasing domains, securing hosts and IP addresses, and orchestrating email dissemination,” researchers noted.

Their strategy involves reviving domains affiliated with big brands, exploiting legitimate services and brands, and circumventing email protection measures, demonstrating their sophisticated technical sophistication.

One of the examples of an abandoned domain being abused in the scam (Credit: Guardio Labs)

The study revealed thousands of active cases of CNAME-takeover and SPF-takeover, which involve stealing abandoned domains of old email/marketing services. These attacks have been ongoing for at least two years, allowing attackers to easily inject their IPs into the domain’s SPF records using the main domain name as the sender.

“Given these sophisticated tactics, we’re clearly facing a formidable operation characterized by significant expenditure and substantial revenue.”

Researchers have launched a “**SubdoMailing**” checker website, enabling domain administrators and site owners to quickly identify and address any abuse detected, ensuring domain security.

1.  **Brand Protection is Essential for Cybersecurity**
2.  **How to Increase Your Business’s Online Brand Awareness**
3.  **Memcyco Introduces Real-Time Solution to Combat Brandjacking**
4.  **Check Point Research: Microsoft the Most Phished Brand in Q2 2023**
5.  **Microsoft, PayPal, Facebook most targeted brands in phishing scams**

ResurrecAds Attack Hijacks Brand Names, Spreads Spam Via ‘SubdoMailing’

By Waqas
LoanDepot identified the ransomware attack on January 4, 2024
This is a post from HackRead.com Read the original post: LoanDepot Ransomware Attack Leads to Data Breach; 17 Million Impacted

LoanDepot suffered a ransomware attack exposing the sensitive data of nearly 17 million individuals including PII data – Now, the company is offering credit monitoring and working to mitigate potential damage.

A major ransomware attack leading to a massive data breach at LoanDepot, a leading mortgage lender, has exposed the personal information of nearly 17 million individuals. In a **data breach notification** to Maine’s attorney general’s office, the company confirmed that the breach took place on January 3, 2024, and was discovered a day later on January 4.

****The Breach:****

Details surrounding the attack remain limited, but LoanDepot acknowledges unauthorized access to their systems, potentially compromising sensitive customer data. While the specific types of information exposed haven’t been confirmed, the letter sent to the **victims of the data breach** suggests it could include their full name, address, email address, financial account numbers, social security number, phone number, and date of birth.

****Impact on Individuals:****

LoanDepot estimates that approximately 16.9 million (16,924,071) individuals have been affected. This includes current and former customers, as well as individuals who inquired about loan products but ultimately did not pursue them.

The company has begun notifying affected parties through letters and emails, outlining the potential scope of the breach and offering resources to help them protect themselves.

****LoanDepot’s Response:****

LoanDepot took immediate action to contain the attack and secure their systems. They launched an investigation in collaboration with cybersecurity experts and notified law enforcement authorities. Additionally, the company has offered one year of complimentary credit monitoring and identity theft protection services to all impacted individuals.

****Uncertainties and Concerns:****

The full extent of the damage caused by this attack remains unclear. The potential for **identity theft** and financial fraud is a significant concern for millions of individuals.

LoanDepot is urging affected individuals to remain alert and take proactive steps to safeguard their personal information, including being cautious of suspicious emails or phone calls, monitoring credit reports for unauthorized activity, and considering placing a freeze on their credit files.

****Regulatory and Legal Ramifications:****

The LoanDepot data breach is likely to attract scrutiny from regulators and may lead to legal repercussions. The Federal Trade Commission (**FTC**) is responsible for enforcing data privacy regulations, and they may investigate the incident to determine if LoanDepot followed appropriate data security practices. Further, affected individuals may have legal recourse against LoanDepot for failing to protect their personal information.

For insights into the LoanDepot data breach, we reached out to **Javvad Malik**, Lead Security Awareness Advocate at KnowBe4 who stated “This breach at LoanDepot is a reminder of the far-reaching consequences of ransomware attacks and it’s concerning to see the scale and sensitivity of the data involved, particularly the inclusion of Social Security numbers, which opens up Pandora’s box of identity theft and financial fraud possibilities.”

Javvad emphasised the importance of employee training within the organisations especially those responsible for data handling. “This incident highlights the critical need for organizations, especially those handling vast amounts of personal information, to invest in strong cybersecurity measures, including threat detection, response strategies, and most importantly, providing employees with timely and relevant security awareness and training.”

****Ransomware Gangs****

While the LoanDepot data breach was confirmed in January 2024, the specific ransomware group responsible for the attack hasn’t been officially disclosed by the company or law enforcement agencies as of today, February 26, 2024.

Nevertheless, ransomware is one of the most prevalent threats to organizations of all sizes. While the United States has **vowed** to take strict measures against ransomware groups, with LockBit ransomware’s recent **demise** and **resurrection**, it is obvious that these groups are here to stay and plan to cause long-term damage.

****Moving Forward:****

While the immediate aftermath of the LoanDepot data breach is concerning, the company’s commitment to transparency and its efforts to mitigate the damage are positive steps. Individuals must remain informed, take appropriate precautions, and actively monitor their financial information to minimize the potential impact of this incident.

1.  **5 Biggest Ransomware Attacks of All Time**
2.  **Kaspersky Reveals Alarming IoT Threats, Dark Web DDoS Boom**
3.  **Ransomware Attack Disrupts Services in 18 Romanian Hospitals**
4.  **Schneider Electric Energy Giant Confirms Cactus Ransomware Attack**
5.  **Hackers Leak 2.5M Private Plane Owners’ Data in LA Intl. Airport Breach**

LoanDepot Ransomware Attack Leads to Data Breach; 17 Million Impacted

By Waqas
LockBit ransomware gang relaunches operation after law enforcement hacked its servers, threatening to target government entities more now.
This is a post from HackRead.com Read the original post: LockBit Ransomware Gang Returns, Taunts FBI and Vows Data Leaks

Despite arrests, infrastructure seizure and international law enforcement efforts, LockBit ransomware has resurfaced, promising robust security and threatening aggressive cyber attacks on UK and USA government sectors.

The LockBit ransomware gang has officially announced its comeback through a detailed message posted on Saturday on its newly created .onion site on the dark web.

The leader of the **LockBit ransomware**, whose identity is still unknown to authorities, admitted negligence in letting the FBI and the UK’s National Crime Agency control its servers via a PHP attack but promised backups and continued operations.

The new dark web leak site of the ransomware gang is already live and adding new alleged companies as its victims (Screenshot credit: Hackread.com)

The announcement comes only a week after the group was neutralized in **Operation Cronos**, a multinational law enforcement investigation, reportedly neutralized the ransomware gang.

For your information, on 19 February 2024, **as reported by Hackread.com**, law enforcement authorities seized LockBit’s infrastructure, including 34 servers that hosted the gang’s data leak website storing stolen data, cryptocurrency addresses, decryption keys, and the affiliate panel causing a major setback to the notorious gang.

The message from the gang’s admin which directly addressed the FBI and the NCA, revealed that servers without PHP installed in backup blogs are unaffected and will continue to release stolen data from targeted companies, even after the FBI hack, and stolen data will be published on the LockBit blog.

The admin claims that Operation Cronos was successful because of their negligence and irresponsibility in “not updating PHP settings on their servers in good time.” They denied Operation Cronos investigators’ claims regarding arresting their two alleged affiliates, the gang donating to a Crimea-based Russian propagandist (Sevastapol Colonel Cassad), and recovering a high number of decryptors. 

However, LockBit confirmed the FBI’s claim that its annual income exceeds $100m, based on data from seized cryptocurrency wallets during Operation Cronos. The group has deleted chats containing evidence of **ransomware payments**, indicating that their revenues exceed US law enforcement estimates. This demonstrates their success despite making mistakes.

The admin wrote that their victim’s admin chat panels server and blog server were running PHP 8.1.2 and were likely hacked using the **CVE-2023-3824** vulnerability. LockBit ransomware has updated its PHP server and offering rewards for finding vulnerabilities in its latest version. LockBit has moved its data leak site to a new.onion address and has targeted five victims with countdown timers to expose the stolen data.

LockBit’s message to the FBI and the NCA – Open in a new tab for a clear view (Screenshot credit: Hackread.com)

Regarding why the FBI hacked their infrastructure, the gang stated that their ransomware attack on Fulton County in January irked the authorities for posing the risk of leaking information on **Donald Trump** court cases and other “interesting things.”

LockBit claims authorities collected over 1,000 decryption keys during Operation Cronos from “unprotected decryptors,” which they defined as low-level malware builds. LockBit plans to upgrade security, manually release decryptors, host affiliate panels on multiple servers, and provide partners with access to different copies.

****RELATED ARTICLES****

1.  **FIN8 Resurfaces with New Sardonic Backdoor**
2.  **Hive Ransomware Resurfaces as Hunters International**
3.  **FBI Disrupts Chinese State-Backed Volt Typhoon’s KV Botnet**
4.  **Mirai botnet resurfaces with MooBot variant to target D-Link devices**
5.  **Nasty Mamba ransomware that encrypts entire hard drive resurfaces**

LockBit Ransomware Gang Returns, Taunts FBI and Vows Data Leaks

By Deeba Ahmed
META is suspending accounts of users on Facebook and Instagram, potentially linked to malicious Vietnamese activity involving META's Oculus.
This is a post from HackRead.com Read the original post: Linked Oculus Accounts Trigger Facebook and Instagram Suspension

Experiencing a sudden Facebook or Instagram account suspension? You’re not alone. Suspicious activity on Oculus accounts linked to META users is going unaddressed as META opts for suspensions instead of addressing the root cause.

Multiple posts on social media platforms like Reddit suggest a sudden rise in Facebook and Instagram account suspensions, causing frustration among users, mainly because they are clueless about why this is happening.

Many users claim their accounts were suspended without warning or explanation, leaving them unaware of the alleged violation. Users complained about seeing a suspension message from Meta that read:

“Your account was suspended because your linked Meta account doesn’t follow our rules. Log into your linked auth.oculus.com account to appeal our decision.”

Users are confused and frustrated due to Meta’s lack of transparency about suspension reasons and limited appeal options whereas the lack of communication from Meta regarding the suspensions is making it difficult to understand and address the situation.

Reddit user r/facebookdisabledme posted: “Facebook suspended my account without giving any specific reason. Trying to appeal is proving to be extremely difficult.”

Users on Facebook, Instagram, and Reddit are reporting a connection between suspensions and their linked Oculus accounts, indicating a potential security issue within the VR platform. Further probing reveals that Vietnamese hackers could be exploiting vulnerabilities in the Oculus Meta system, which was acquired by Meta in 2014.

“There were 2 logins from Vietnam into my account (I’m from Belgium). Most likely that’s why Facebook suspended the account immediately? But I didn’t get any recovery mail or explanation” user u/Mammoth\_Resolution\_7 shared on Reddit.

One user claimed the hacker linked Meta Horizon account to his Facebook and another reported linking of Meta Oculus. 

According to sources, hackers are creating Oculus Meta accounts and linking them to victims’ social media accounts, registering them as unauthorized access, which is leading to thousands of account suspensions.

For your information, Meta introduced Meta Accounts in 2022 to allow the decoupling of Quest users’ devices from their Facebook profiles. This change was deemed inevitable as it prevented users from losing access to their Oculus Meta account if their Facebook account was banned. However, multiple accounts are still linked, affecting many Facebook or Instagram accounts’ safety.

It is also worth noting that Vietnamese cybercriminals have a history of targeting META and business pages on the platform, with instances of **using DarkGate malware** to steal login credentials.

Nevertheless, META almost member addresses why it suspends user accounts. However, to avoid account suspensions, users should review Meta’s Community Standards, check for official announcements on their website or social media platforms, contact Meta Support through their official channels, and be patient and persistent in navigating the appeal process.

Meta should provide clear communication and address concerns promptly and transparently, as it is crucial for users to understand the specific reason for their account suspension and to be patient and persistent in their efforts to reach out to them.

1.  **Vietnamese Group Hacks and Sells Bedroom Camera Footage**
2.  **Vietnamese man hacked Aussie airport systems; stole security data**
3.  **Fake ChatGPT and AI pages on Facebook are spreading infostealers**
4.  **New Phishing Scam Hooks META Businesses with Trademark Threats**
5.  **Provocative Facebook Ads Leveraged to Deliver NodeStealer Malware**

Linked Oculus Accounts Trigger Facebook and Instagram Suspension

By Deeba Ahmed
Avast Hit with $16.5 Million Fine, Settles with FTC Over Deceptive Data Practices, Forced to Delete User Information
This is a post from HackRead.com Read the original post: Avast Fined Millions for Selling User Browsing Data

Avast, a popular antivirus software, has been fined $16.5 million for selling user browsing data despite claims of protecting privacy. The FTC accused them of misleading users and selling sensitive information without consent. Avast agreed to settle, stop selling data, and delete user information.

The US Federal Trade Commission (FTC) has imposed a $16.5 million fine on Avast Limited, **Avast Software,** and Jumpshot for deceiving users by claiming its software would eliminate web tracking but doing the tracking itself.

It is worth noting that, the Prague, Czech Republic-based anti-malware and cybersecurity vendor stored the data indefinitely and sold it without consumers’ consent or notice while promising users exemplary privacy protection.

This development reflects the continuation of the FTC’s crackdown on companies involved in deceptive data privacy practices. In January 2024, it reached a **settlement** with Outlogic to prevent selling information for tracking user locations and **banned** InMarket from selling precise user locations.

The FTC’s Director of Consumer Protection, Samuel Levine, criticized Avast’s bait-and-switch surveillance tactics for violating consumer privacy.

In its complaint, available **here** (PDF), the FTC revealed that cybersecurity software company Avast collected consumers’ browsing information through its browser extensions and antivirus software, including Avast Extensions, Avast Secure Browser, Avast Mobile Software, and Avast Desktop Software. The FTC accused Avast of selling its data to over 100 third parties via Jumpshot.

For your information, in 2013, Avast acquired competitor Jumpshot, rebranded as an analytics company, and sold browsing information collected from consumers from 2014 to 2020 through it. The FTC accused Jumpshot of offering products that enabled user tracking and associating browsing histories with third-party information.

Jumpshot entered a contract with Omnicom, offering an “All Clicks Feed” for 50% of customers in the US, UK, Mexico, Australia, Canada, and Germany, and earned millions in gross revenues. Avast’s dubious data privacy practices were exposed in 2020 in a joint investigation, leading to the **shutdown of Jumpshot**.

Reportedly, the company collected data on religious beliefs, health concerns, political views, locations, and financial status from 2014 to 2020. The FTC found Avast failed to adequately anonymize browsing information despite the company claiming otherwise.

FTC also discovered that Avast sold data with unique identifiers for each browser, which exposed crucial data like visited websites, timestamps, user location, and the type of device and browser.

Avast agreed to settle the case with the FTC, paying $16.5 million. The order also requires Avast to stop selling or licensing browsing data to advertisers, delete all data obtained by Jumpshot, and notify affected customers of the sale.

How Jumpshot functioned

Avast’s spokesperson, Jeff Monney, reaffirmed the company’s commitment to protecting and empowering users’ digital lives, citing disagreement on the allegations while opting for a settlement.

Data privacy violations can lead to significant financial consequences for companies like Avast, including fines, lawsuits, lost business, reputational damage, and negative press coverage. Regulatory bodies enforce data privacy laws and can sue companies, resulting in further financial losses and legal costs, as evident in Avast’s case.

****RELATED ARTICLES****

1.  **HelloFresh Fined £140,000 for 80 Million Spam Messages**
2.  **Unreleased Music Stolen and Sold on Dark Web: Hacker Fined**
3.  **Google Incognito Mode: New Disclaimer Reveals Data Tracking**
4.  **Meta Fined €265 million in Facebook Data Scraping Case in the EU**
5.  **Sephora Fined $1.2 Million for Breaching CCPA and Selling User Data**
6.  **Apple and Samsung fined millions for slowing down old smartphones**

Avast Fined Millions for Selling User Browsing Data

By Owais Sultan
British Virgin Islands, 26 February 2024 – Friendzone, the sustainable and scalable Web3 platform redefining Social Finance (SocialFi)…
This is a post from HackRead.com Read the original post: Friendzone Launches Social Monetization on Polygon PoS for 5,000+ Waitlisted Users

**_British Virgin Islands, 26 February 2024_** – Friendzone, the sustainable and scalable Web3 platform redefining Social Finance (SocialFi) on the blockchain, has officially launched on the Polygon Proof-of-Stake network. The launch of the Social Capital Marketplace is the first of many key milestones for Friendzone in its mission to become the number #1 social media **dApp** in the Web3 industry. 

Friendzone is an entirely novel decentralized protocol that marries the engagement of traditional social media with the unique financial rewards enabled by **Web3 technology**, paving the way for the creation of more empowering online communities. In this way, Friendzone is much more than just another SocialFi platform.

It represents a paradigm shift that not only recognizes social media presence and influence but rewards it in tangible and monetizable ways. It promises to redefine the social media industry as a place where every interaction can potentially generate value, empowering content creators and users alike to monetize their online experiences seamlessly. 

The launch on Polygon PoS coincides with the closure of a significant funding round led by angel investors including Kain Warwick (Founder of Synthetix), Kieran Warwick (Founder of Illuvium), Danny Wilson (CFO of Illuvium), Thomas Aslanian (Product & Token Lead of Immutable), Anton Buenavista (Founding Team Pendle Finance), Jackson Chan (Co-Founder of PHD Capital) and many other incredible angels with experience at Synthetix, Pendle Finance, Bybit, Metastreet Labs and Renzo Protocol.

Alongside the round, which brings Friendzone’s total amount raised to more than USD 750,000, the startup is pleased to welcome the aforementioned investors, plus TN Lee (Co-Founder of Pendle Finance) and John Park (Partner at Sparklabs) to its growing advisory board. 

Although Friendzone is competing in an increasingly crowded SocialFi space, its platform is differentiated from others through its nuanced incentive and protocol design. Friendzone is uniquely focused on overcoming the scalability and liquidity challenges that have hampered the growth of first-generation SocialFi platforms, setting it up to become the first protocol of its kind to go mainstream. 

Friendzone has designed its protocol economics around an adaptive bonding curve that takes into account market feedback in real-time, ensuring that its token valuation is always fair, with continuous access for both small and large networks. Through this mechanism, it promotes sustained engagement and network growth without being constrained by the accessibility and liquidity bottlenecks that have held back alternative SocialFi protocols. 

With its custom creator controls, Friendzone empowers everyone to be a creator with the ability to customize their social media activity and create tailored offerings ranging from public events to private groups, where they can set terms and prices that better reflect the value they provide.

Besides the purchase and sale of its “Creator Chips”, Friendzone incorporates a staking feature into its tokenomics model that takes into account both the quantity and duration of the user’s stake. It’s inspired by Curve’s veCRV model and aims to ensure a more equitable distribution of each creator’s revenue, incentivizing network users to actively contribute to the success of every creator with a share of their rewards. 

Through these novel innovations, Friendzone promises to transcend the emotional incentives of traditional social media networks by integrating powerful financial incentives enabled only with crypto, amplifying its network effects to enhance user engagement and fairly reward participation on the platform and all integrated decentralized applications existing today. 

****A Progressive Rollout****

Friendzone has generated enormous interest before its launch on Polygon PoS, with more than 5,000 whitelisted users signed up. To ensure stability during its incentivized beta rollout, the protocol is capping the number of users allowed onto the network in batches of 1000. The plan is to progressively onboard more users as the project demonstrates its worth and evolves from its beta stage, where it will be closely monitored for bugs and refined to provide an optimal user experience. 

The initial 1000 users selected to participate in the launch can now head to X, formerly known as Twitter, to claim their Friendzone handles, which will be the same as their X handles.

During the initial launch period, Friendzone will also integrate a new points system into its protocol, enabling early adopters who beta test the product to begin accumulating points to enhance their rewards and reputations on the platform. 

“We are immensely proud to launch Friendzone with the support of the Polygon ecosystem, a collaboration that marks a significant milestone in our journey. The Polygon PoS Network’s exceptional scalability, speed, and security offer the perfect foundation for Friendzone, enabling us to redefine social media engagement and monetization in the Web3 space.

The commitment to innovation and the success of projects built on Polygon PoS is unparalleled. This strategic relationship is a testament to our shared vision of empowering users and creators in a disruptive decentralized digital economy.” said Kevin Lu, CEO & Co-Founder of Friendzone.

Friendzone is delighted to bring its collaboration with the Polygon ecosystem to the next level, tapping into its powerful ecosystem and leveraging its expertise to explore new use cases and accelerate innovation in the SocialFi space. Friendzone is poised to unleash new dynamics and explore uncharted waters on Polygon PoS as it seeks to bring more value to users in the nascent decentralized social media industry. 

The Polygon ecosystem has already distinguished itself in the blockchain arena with its strong ethos of innovation and a litany of unparalleled strategic brand collaborations, making it an ideal landing spot for Friendzone. The protocol’s integration with the Polygon network enables it to make plans toward tapping into an innovative zkEVM-based Layer-2 architecture that will be instrumental in accelerating its growth as it scales its network and expands its user base.

The Polygon networks are home to some of the most dynamic and diverse ecosystems of groundbreaking dApps and communities in the blockchain world, providing further opportunities to collaborate, innovate and bring SocialFi into the mainstream. 

“Friendzone represents the first of its kind in the SocialFi space, pioneering a new era of social media that rewards engagement with real value. We are proud to have Friendzone build on Polygon PoS and to work closely with their team to achieve our mutual goals. Their innovative approach to integrating social interactions with value incentives sets a new standard in the industry. This collaboration underscores Polygon’s dedication to supporting groundbreaking projects that push the boundaries of what’s possible in Web3 and beyond.” said SungMo Park, Head of BD APAC at Polygon Labs.

Today’s launch and funding round represents the first of many milestones to come for Friendzone, laying the groundwork for a truly interoperable protocol that will provide a scalable foundation to support the monetization layer of on-chain social graphs. 

****About Friendzone****

Friendzone is the premier social Web3 platform introducing real-time adaptive pricing and native reward distribution to ensure fair and dynamic value exchange, tailored to a creator’s reputation and community support. The platform is the first to incentivize sustained engagement and offers creators extensive control over content monetization, promoting a robust and inclusive digital circular economy at scale.

Friendzone is supported by a dedicated team of core contributors and advisors from industry-leading entities such as Synthetix, Band Protocol, Koinly, Immutable, Pendle Finance, Cyball, and Sparklabs.

1.  **GAM3S.GG Raises $2M to Grow Web3 Gaming Superapp**
2.  **Particle Network’s Intent-Centric Approach Aims and Secure Web3**
3.  **Web3 Needs A Decentralized Infrastructure That IPFS Cannot Deliver**
4.  **Signal21 Beta Launch Bridges Gap in Blockchain Intelligence Services**
5.  **READYgg Gets Web2 Players into Web3 in Partnership with Aptos Labs**

Friendzone Launches Social Monetization on Polygon PoS for 5,000+ Waitlisted Users

By cyberwire
Brea, California, February 26th, 2024, Cyberwire – The current large surge in cyber threats has left many organizations…
This is a post from HackRead.com Read the original post: ThreatHunter.ai Halts 100s of Attacks: Battling Ransomware & Nation-State Cyber Threats

**Brea, California, February 26th, 2024, Cyberwire** – The current large surge in cyber threats has left many organizations grappling for security so ThreatHunter.ai is taking decisive action. Recognizing the critical juncture at which the digital world stands, ThreatHunter.ai is now offering its cutting-edge cybersecurity services free of charge to all organizations for 30 days, irrespective of their current cybersecurity measures. 

James McMurry, Founder of ThreatHunter.ai, reflects on the situation’s urgency: “In the past 48 hours alone, we have stopped hundreds of actual attacks and performed mitigations for our customers. Yet, the frequency and sophistication of these attacks are escalating at an alarming rate. Our mission is clear: to extend our protective reach to every organization in need, ensuring that the digital frontier is safe for all.”

Drawing on recent events and the resilient nature of cyber threats, as highlighted in an insightful piece on the LockBit ransomware saga, it’s evident that the cybersecurity landscape is more volatile than ever. The LockBit group’s audacity in bouncing back after a significant takedown operation underlines the persistent and evolving threat posed by cybercriminals. 

ThreatHunter.ai, with its elite team of threat hunters, engineers, and cybersecurity experts, employs the ARGOS platform to provide real-time threat detection and mitigation. Our AI and ML-driven technologies have been pivotal in safeguarding organizations from the ever-evolving tactics of cyber adversaries.

“We see the problem getting larger, with cyber threats becoming more sophisticated by the day. Offering our services for free for 30 days is our way of bolstering the defences of organizations across the globe. It’s a call to action for everyone, and to show that ThreatHunter.ai is much more than all the MDRs offering automated alerts, we actually will stop threats, and how our team operates as part of our customers’ cyber team,” McMurry emphasizes.

This initiative is not just about offering a temporary solution; it’s about raising awareness and driving home the point that in the face of rising cyber threats, complacency is not an option.

Organizations interested in taking advantage of ThreatHunter.ai’s complimentary 30-day services are encouraged to reach out immediately. Together, we can turn the tide against the cyber threats that loom large over our connected world.

****About ThreatHunter.ai****

ThreatHunter.ai is at the forefront of cybersecurity, specializing in real-time detection, analysis, and mitigation of cyber threats. Powered by the innovative ARGOS platform, our approach combines advanced AI and ML technologies with the expertise of the industry’s most skilled professionals. We are dedicated to defending the digital infrastructure against the complex landscape of cyber threats, ensuring peace of mind for businesses and governments worldwide.

ThreatHunter.ai, a 100% Service-Disabled Veteran Owned Small Business, is a leading provider of AI-driven threat-hunting solutions. Its advanced machine learning algorithms and expert analysis help organizations detect, identify, and respond to cyber threats. Its solutions are designed to supplement existing security resources and provide a fresh perspective on how to address today’s complex cyber threats.

Don’t miss the opportunity to safeguard your organization with the unparalleled cybersecurity protection offered by ThreatHunter.ai. Visit our website at www.threathunter.ai to explore our unique approach, learn more about our cutting-edge solutions, and discover how we can empower your business to stay ahead of cyber threats.

To speak with our experts or schedule a personalized demo, reach out to our sales team at \[email protected\] or call 714.515.4011. Take action today and ensure the security and resilience of your digital infrastructure.

****Contact****

*   **Lydia Coulter**
*   **Marketing and Media Manager**
*   **ThreatHunter.ai**
*   **7145154011**
*   **\[email protected\]**

ThreatHunter.ai Halts 100s of Attacks: Battling Ransomware & Nation-State Cyber Threats

By Waqas
Friend or Foe?
This is a post from HackRead.com Read the original post: Russian Ministry Software Backdoored with North Korean KONNI Malware

Discover the latest cybersecurity revelation: KONNI malware, linked to North Korean cyber operations, targets the Russian Ministry of Foreign Affairs. Learn about the sophisticated tactics and geopolitical implications

German cybersecurity firm DCSO has discovered a malware sample uploaded to VirusTotal in January 2024, believed to be part of North Korea-linked activity targeting the Russian Ministry of Foreign Affairs (MID). The malware is believed to be **KONNI**, a North Korean nexus tool used since 2014.

KONNI, first **discovered in 2014**, is associated with the Democratic People’s Republic of Korea (DPRK)-nexus actors like Konni Group and TA406. The malware has unique stealer functionality and remote administration capability. It’s installed in an MSI file, with C2 servers encrypted with AES-CTR, and a CustomAction for detection and payload selection.

In the latest discovery, researchers noted that KONNI’s command set remains unchanged, allowing operators to execute commands, upload/download files, specify sleep intervals, communicate via HTTP, and compress file extensions into .CAB archives.

> #ShortAndMalicious  
> Our researchers recently discovered an installer for the mandatory 🇷🇺Russian tax filling software "Spravki BK" (Справки БК) which was backdoored with #KONNI malware, generally attributed to 🇰🇵North Korean threat actors. 1/5
> 
> — DCSO CyTec (@DCSO\_CyTec) October 17, 2023

Interestingly, the sample **DCSO analyzed** was delivered via a backdoored Russian language software installer, similar to a previously observed KONNI delivery technique. The sample was for a tool called “Statistika KZU”, which is believed to be intended for internal use within the Russian MID. The software is used for relaying annual report files from overseas consular posts to the MID’s Consular Department via a secure channel.

Additionally, two user manuals were found in the backdoored installer, detailing the installation and usage of the “Statistika KZU” program. The first manual explains installing the program on an administrative account, providing minimum software requirements and screenshots.

The second 22-pager manual, “StatRKZU\_Pyкoвoдcтвo,” outlines how to use the software for generating annual report files on KZU consular activities, including templates for calculating registered and detained citizens.

The MID’s software, identified as “GosNIIAS” (a Russian federal research institute primarily involved in aerospace research), was tested offline and found legitimate. Despite no direct correlations between GosNIIAS and Statistika KZU, references to contracts were found, including a procurement order for automated system maintenance and data protection software.

This discovery comes amid increasing geopolitical proximity between Russia and the DPRK, following Russia’s renewed invasion of Ukraine in 2022.

****Russia and North Korea’s Cyber Standoff****

This is not the first time Russia and North Korea have made collective headlines over cybersecurity threats. **In August 2023**, the world witnessed another significant incident when “elite North Korean hackers” affiliated with OpenCarrot and the Lazarus group breached NPO Mashinostroyeniya, a key Russian missile developer. This breach, lasting for at least five months, revealed the alarming capabilities and determination of the attackers.

****Previous Use of KONNI Backdoor****

KONNI has been used in many cyberespionage campaigns targeting Russian agencies. FortiGuard Labs discovered a KONNI malware campaign **in November 2023**, targeting Windows systems through Word documents with malicious macros. Malwarebytes researchers **discovered** a campaign in mid-2021 using Russian language lures concerning Russian-Korean trade and economic issues and a meeting of a Russian-Mongolian intergovernmental commission.

An unknown hacking group **targeted** North Korean organizations using KONNI Malware in 2017. Three campaigns were identified back then- two by Talos Intelligence, a Cisco-owned cybersecurity firm, and the third reported by Cylance security firm.

For insights into this, we reached out to John Bambenek, President at Bambenek Consulting, who emphasised that “It is not uncommon for intelligence agencies to spy even on their putative allies, if for nothing else, for insights to either strengthen the relationship or to identify and mitigate threats.”

Mr. Bambenek highlighted that “The use of a backdoor in software used almost exclusively by the Russian Foreign Ministry stands out and shows that the DPRK did their research here for a particular hook into their victims and is, ironically, a more targeted and precise adaptation of the approach Russian intelligence used with **NotPetya**.”

“Espionage has a couple of nuances where sometimes you want more sophisticated tools and for some attacks, you want narrow and simpler tools. For espionage, you want long-term persistent infection and sophisticated and interactive tools provide defenders more opportunities for detection. It’s not uncommon to see tools used for espionage that lack some of the obfuscation commonly observed in **cybercrime tools**,” he added.

****RELATED ARTICLES****

1.  **Gone: Russian Central Bank hacked; $31 million stolen**
2.  **2 Russian Industrial Firms Hacked, 112GB of Data Leaked**
3.  **Anonymous Leaks 128 GB of Data from Russian ISP Convex**
4.  **Elite North Korean Hackers Breach Russian Missile Developer**
5.  **Anonymous Hacks Central Bank of Russia; Leaks 28GB of Data**

Source

HackRead