Tech News
People caught downloading copyright-protected content from torrent websites – including popular repositories like The Pirate Bay,Torrentz, and more – could face up to 10 years in prison under UK law. The Digital Economy Act has received royal assent, meaning UK file-sharers could now be imprisoned for a decade. Following a recommendation from the International Property Office, IPO, the maximum prison sentence for copyright infringement in the UK has been increased from two years – to 10. The IPO had previously commissioned a study that suggested online copyright infringement should carry similar sanctions to those used for counterfeiting offences.
When it comes to privacy concerns, the mind naturally drifts to the likes of Facebook, Microsoft and Google. But in reality, there is the potential for privacy issues with any connected device -- and that includes Bluetooth headphones from Bose. Illustrating this is a man from Illinois who has filed a lawsuit against the Massachusetts-based audio company for secretly collecting, transmitting, and disclosing its customers private music selections to third parties, including a data mining company. Kyle Zak alleges that his Bose QuietComfort 35 wireless Bluetooth headphones and the associated Bose Connect app gathered information about him, and sold it on to third parties including Segment.io. Zaks lawsuit points out that the same problem probably exists with other Bose Bluetooth headphones that work in conjunction with the Bose Connect app. Other affected products include the Bose SoundSport wireless, SoundSport Pulse wireless, QuietControl 30 and SoundLink wireless II headphones, as well as its SoundLink Color II, SoundLink Revolve and SoundLink Revolve+ speakers. The allegation is that Bose is engaged in what amounts to wiretapping, but Bose denies that data is personally identifiable.
The hackers are particularly upset after Evan Spiegel, Snapchat CEO, reportedly made a rather nasty remark regarding expansion plans. According to claims that emerged last week as an ex-employee filed a lawsuit against the company, Spiegel shut down suggestions to expand to certain international markets, saying Snapchat is for rich people and did not want to expand into poor countries like India or Spain. The allegations were slammed by the company. Obviously Snapchat is for everyone! It is available worldwide to download for free. these words were written by a disgruntled former employee. We are grateful for our Snapchat community in India and around the world! Snap said. After a widespread boycott campaign was launched, demanding Spiegel to apologize, hackers did their part. In fact, the Indian hackers claim the vulnerability they discovered in Snapchats database allowed them to siphon details on 1.7 million users sometime last year. To make matters worse, the database has been leaked on the dark web.
A smart dishwasher has reportedly been found connected to an unsecured web server, giving experts further arsenal to warn about the dangers of IoT devices. A bug report by a security expert alleges that Miele, the manufacturer of the smart dishwasher, ignored the security issue despite having been notified of it, indicating that the smart device may have been left exposed to an unsecured server for months. According to Jens Regel of Schneider & Wulf, Mieles Professional PG 8528 PST10 devices were found to be prone to a directory traversal attack; therefore, an unauthenticated attacker may be able to exploit this issue to access sensitive information to aide in subsequent attacks. According to Regel, he was able to get his hands on the embedded systems shadow file, which in turn provided him access to all files in the system. We are not aware of an actual fix, Regel said. According to Mieles product description page, the ethernet connection is used to extract text reports from the dishwasher. The ethernet interface is the universal solution for data exchange, the description states. In comparison with other interfaces the user is offered a particularly high level of functionality. However, security experts have reportedly bemoaned such situations, warning about the potential dangers such security flaws could pose, and the IoT security situation is unlikely to get any better any time soon. The price of turning a dumb device into a smart device will be about 10 cents. It is going to be so cheap that vendors will put the chip in anything electronic they produce, even if the benefits are only very small. But those benefits will not be benefits to you, the consumer -- they will be benefits for the manufacturers because they want to collect analytics, and you will probably not even know that it is an IoT device.
The dark web has been flooded with millions of accounts from recently compromised vBulletin forums. A hacker using the name Cfnt claimed to have hacked 25 web forums, which were running on outdated versions of the vBulletin software. Among the compromised forums are subagames.com, rappers.in, forums.spybot.info, cashcrate.com, codingforums.com, dcemu.co.uk, asia-team.net, dbforums.com and forums.3dtotal.com. Around 38 million accounts from the 25 hacked forums are now up for sale in a popular dark web marketplace. The hacked forums were all running on vBulletin 4.x, which is vulnerable to SQL injection. The security issue with this version was reported in June 2016, according to vBulletin support forums. A warning to those using older vBulletin versions last year reads: A security issue was reported to us that affects vBulletin 4. We have released security patches for vBulletin 4.2.2 & 4.2.3 to account for this vulnerability. The issue could potentially allow attackers to perform SQL Injection attacks via the included Forumrunner add-on. It is recommended that all users update as soon as possible. If you are using a version of vBulletin four older than 4.2.2, it is recommended that you upgrade to the latest version as soon as possible. Lists of accounts from each of the forums are being sold for around $150. It is highly recommended that users with accounts on such vBulletin forums change their passwords now.
Police in Minnesota want to solve a crime by combing through Google search history. Officers in Edina, a city of around 50,000 people, got a warrant compelling Google to divulge information about people who searched for the name of a financial fraud victim between Dec. 1, 2016 and Jan. 7, 2017. Someone convinced a credit union to wire $28,500 from an Edina mans account by creating a fake passport using the mans name alongside a photo of someone else. In their warrant application, police stated that the fake photo came up by googling the victims name, but did not come up in other search engines. The warrant for the five-week period compels Google to hand over information regarding anyone who searched the victims name, including email addresses, social security numbers, birthdates, IP addresses and information related to the content the user is viewing/using.