Creepto Cash: personal data of thousands of users from the UK, Australia, South Africa, the US, Singapore exposed in bitcoin scam
Group-IB, a global threat hunting and intelligence company headquartered in Singapore, has discovered thousands of personal records of users from the UK, Australia, South Africa, the US, Singapore, Spain, Malaysia and other countries exposed in a targeted multi-stage bitcoin scam. Victim’s phone numbers, which in most cases came with names and emails, were contained in personalized URLs used to redirect people to websites posing as local news outlets with fabricated comments of prominent local personalities about cryptocurrency investment platform that «helped them build a fortune». The source of the leak has not been established yet. The information has been provided to relevant authorities in the affected countries.
AT&T dragged to court, again, over SIM hijacking and cryptocurrency theft
AT&T is being sued for the second time over the alleged theft of cryptocurrency belonging to a customer, facilitated by a SIM-swap attack. Seth Shapiro, an advisor in business and technology, claims that his “life savings” were stolen after an AT&T employee facilitated the transfer of a phone number to a hacker’s control. SIM-swapping attacks involve the fraudulent transfer of a phone number from a victim’s control to a criminal. This often includes the use of social engineering techniques, such as an attacker claiming to be the victim and using previously-stolen or leaked personal information to support their case, or the involvement of an insider party to make the change.
Uncovered: 1,000 phrases that incorrectly trigger Alexa, Siri, and Google Assistant
As Alexa, Google Home, Siri, and other voice assistants have become fixtures in millions of homes, privacy advocates have grown concerned that their near-constant listening to nearby conversations could pose more risk than benefit to users. New research suggests the privacy threat may be greater than previously thought. The findings demonstrate how common it is for dialog in TV shows and other sources to produce false triggers that cause the devices to turn on, sometimes sending nearby sounds to Amazon, Apple, Google, or other manufacturers. In all, researchers uncovered more than 1,000 word sequences—including those from Game of Thrones, Modern Family, House of Cards, and news broadcasts—that incorrectly trigger the devices. “The devices are intentionally programmed in a somewhat forgiving manner, because they are supposed to be able to understand their humans,” one of the researchers, Dorothea Kolossa, said. “Therefore, they are more likely to start up once too often rather than not at all.”
One out of every 142 passwords is ‘123456’
In one of the biggest password re-use studies of its kind, an analysis of more than one billion leaked credentials has discovered that one out of every 142 passwords is the classic “123456” string. The study, carried out last month by computer engineering student Ata Hakçıl, analyzed username and password combinations that leaked online after data breaches at various companies. These “data dumps” have been around for more than half a decade, and have been piling up as new companies are getting hacked. The data dumps are easily available online, on sites like GitHub or GitLab, or freely distributed via hacking forums and file-sharing portals.
Google removes ads served to users seeking voting info for ‘misrepresentation’
Google said on Monday it had removed ads for companies that charge people large fees to register to vote or harvest their data, which appeared when users searched for voter information. A Google spokeswoman told Reuters that the company’s misrepresentation policy barred such ads, which were found by the nonprofit watchdog Tech Transparency Project when searching for terms such as “register to vote,” “vote by mail,” and “where is my polling place.” As in all major democracies, voters in the United States do not have to pay to register to vote. Tech Transparency Project said in a report on Monday that nearly a third of the more than 600 ads generated by its Google searches took users to sites that try to charge large fees for voter registration services, extract personal data for marketing purposes, install deceptive browser extensions, or serve other misleading ads.
