USC Data Science Program 529 (DSci 529): Security and Privacy in Informatics - Spring 2021

Lecture Friday - Noon to 3:20PM PM
Clifford Neuman

Current Events for April 9th 2021

Content Regulation

In order to silence twitter for failing to remove content involving child pornography, drugs, and suicide, Russia has implemented a novel censorship method, throttling. Instead of blocking the social media, throttling slows down the traffic and degrades the quality of the service. However, this method is targeting t.co domains, which affects other services such as Microsoft.com or reddit.com, which led to widespread internet problems. – Jiemin Tang

A University of Michigan team used Censored Planet, an automated censorship tracking system developed by an assistant professor of electrical engineering and computer science Roya Ensafi, to collect more than 21 billion measurements over 20 months in 221 countries. This largest collection of public internet censorship data ever compiled shows that even citizens of the world’s freest countries are not safe from internet censorship. Many countries start with legislation that compels internet service providers to block something that’s obviously bad like child sex abuse material. But once that blocking infrastructure is in place, governments can block any websites they choose, and it’s usually a very opaque process- Ye Zeng

Receent Data Breaches

Information scraped from around 500 million LinkedIn user profiles is part of a database posted for sale on a website popular with hackers. - Congrui Li

The personal information of about half a billion Facebook users, has been leaked and posted to a website used by hackers. The information leaked includes full name, location, birthday, email addresses, phone number, and relationship status. Since these data is all in one place and is easily accessible, it makes social engineering attacks quicker and easier. — Haipeng Yu

On Saturday, hundreds of millions of Facebook users' personal data including phone numbers, Facebook IDs, full names, locations, bios, etc, were published online for free and the leaking event was caused by a vulnerability that the company patched in 2019. According to Alon Gal, the chief technology officer of the cybercrime intelligence firm Hudson Rock, he suggested that Facebook could notify users so they could remain vigilant about phishing schemes or fraud using their data. –Zixin Zheng

Accellion, a 3rd party provider of 'secure' file transfer technologies, has announced that their File Transfer Appliance (FTA) has been compromised in a data breach. In December, an attacker used two unknown vulnerabilities in the software to download files from the FTA system, without authentication. The vulnerability was patched that same month, however, by January, two new vulnerabilities were exploited to repeat the same attack. Organizations affected by Accellion’s FTA data breach include Kroger, Jones Day law firm, University of California, Stanford, US Department of Health and Human Services, HealthNet, Trinity Health, and more. Regulators point out that, with the FTA product being 20 years old, and subject to previous known SQL injection, and cross site scripting vulnerabilities, that not only could Accellion be found negligent for keeping the product on the market – clients that were notified about these vulnerabilities and yet refused to migrate to other products, may also be responsible for putting consumer's information at risk. --Philana Williams

Privacy Regulation and other Government Regulation

The Japanese government has issued a substantive revision of the "Japan Personal Information Protection Act" ("APPI") with an effective date of April 1, 2022. Personal Information Protection Commission (“PPC”) authority to request foreign entities which supply goods or services in Japan and handle personal information of individuals in Japan to submit reports or to issue orders in case of violations of the APPI, which can be enforced with a penalty. However, some of the amendments took effect earlier in January 2021 and December 2020. –Yixiang Cao

Exploiting GDPR to leak sensitive user information has been shown possible by a group of researchers using attacks such as impersonation. – Kung-Hsiang (Steeve) Huang

A newly approved regulation strengthens the CCPA and bans the use of "dark patterns" or designs that are used to trick and frustrate consumers from being able to stop the selling of their personal data. It strengthens consumers' abilities to exercise their privacy rights and bans the use of confusing language or long texts that users have to sift through to find the opt-out button. – Danielle Sim

California Consumer Privacy Act(CCPA) conducts additional stricter regulations and laws in privacy protection in California. Recently new regulations were approved to ban the ‘Dark Patterns’ — tricks in websites or apps that frustrate or bamboozle users into doing things they wouldn’t normally do. Users are annoyed a lot by those tactics, usually being almost forced to see some advertisements, subscribe some content or consent to grant some privacy privileges. These new regulations can help to improve the user experience and web environment and can help to better protect users’ privacy as well. – Lingyu Ge

A good news for CSOs and CISOs is that both CPRA and VCDPA will be effective on Jan 1, 2023, which give them an identical time frame to meet the requirements. However, VCDPA is more like a mixture of CCPA, GDPR AND CPRA and will make companies’ business activities more complicated and lower the appealing of certain types of information processing.– Mingliao Xu

The Council adopted conclusions on the EU's cybersecurity strategy that outlines the framework for EU action to protect EU citizens and businesses from cyber threats. The conclusions note that cybersecurity is essential for building a resilient, green and digital Europe. In its conclusions, the Council highlights a number of areas for action in the coming years.– Bolong Pan

Rep. Suzan DelBene reintroduced legislation Wednesday aimed at creating a national standard for data privacy. The legislation would require businesses to get affirmative consent from users before sharing their sensitive information, like financial account numbers, health information or SSNs. It would also let users opt-out of the collection of other nonsensitive data.

A baseline federal privacy law should make clear the responsibilities for those companies that choose to collect and use personal data. And the law should establish clear rights for those whose personal data is held by others. Every effort should be made to minimize the collection of personal data where possible.– Bolong Pan

The post points out Virginia has become the second state that enacts comprehensive privacy legislation after Governor Ralph Northam signed the Virginia Consumer Data Protection Act (VCDPA). This post takes a look at the VCDPA provisions that are novel and require close attention by companies. The new ground of the bill is that it includes a category called "sensitive data" which can only be processed with users' consent. - Yi Jin

Virginia Gov. Ralph Northam (D) signed the Consumer Data Protection Act on Tuesday, making Virginia the second state in the U.S. to pass a comprehensive data privacy law. The bill will give consumers the right to opt out of having their personal data processed for targeted advertising and the right to confirm if their data is being processed. Other states are also considering data privacy proposals. –Yixiang Cao

Massachusetts is one of the first states to put legislative guardrails around the use of facial recognition technology in criminal investigations. The state managed to strike a balance on regulating the technology, allowing law enforcement to harness the benefits of the tool, while building in protections that might prevent the false arrests that have happened before. - Aziza Saulebay

Instagram will be rolling out new teen-focused privacy updates following its competitor Tiktok’s move earlier this year that is largely blessed by parents of the teens using the social app. The new feature will restrict adult users from being able to contact teens who didn’t already follow them. In addition, the teen will receive notification of suspicious behaviors of the adults they are DM’ing with and they can choose to block, report or restrict the adult from further contact. — Haipeng Yu

During the enforcement process of most data protection rules, encryption has become a hot subject of debate. The security of confidential data is important in an era where organizations are coping with vast amounts of data on a regular basis. One such data protection legislation calls for the use of cryptography on a variety of occasions. GDPR is a European Union data protection regulation that addresses encryption. -Supreet Randhawa

Booking, a major hotel booking site, has been fined €475,000 because they failed to report a serious data breach with thin the time period mandated by the GDPR(General Data Protection Regulation) In 2018 Booking was suffered the breach back when phone scammers targeted 40 employees in the United Arab Emirates(UAE. Scammers got about 4100 customers booking history in the UAE via the site.— Hehan Xie

On Wednesday, two advocacy groups requested the U.S. Federal Trade Commission (FTC) to investigate whether apps that Google’s Play Store labels as “Teacher approved” are illegally collecting personal data without parental consent in order to target ads at children.Since last June in 2020, the Campaign for a Commercial-Free Childhood (CCFC) and the Center for Digital Democracy (CDD) cited among other evidence reports from three separate research groups that could used to believe that Play Store apps aimed at children secretly transmitted individual users' data to other companies.Alphabet Inc’s Google insisted that they did protect the privacy of users in response to Wednesday’s complaint that its app store is – Lei Gao

Two advocacy groups called on the U.S. Federal Trade Commission to investigate whether apps that Google’s Play Store labels as “Teacher approved” are unlawfully collecting personal data without parental consent to target ads at children. – Rosy Zhou

Facebook was sued by Noah Duguid when he believed that Facebook violated the TCPA by sending him a text message even though he does not have a Facebook account. The case was moved from State court up to the Supreme Court by the Statemaking the term of robocalls too broad. The Supreme Court unanimously felt that Facebook text message is not correctly classified by a robocall, since robocalls are instigated by randomly generating numbers and randomly calling the numbers. Facebook sends messages to individuals who use their platform only when necessary, such as if Facebook believes that their account has been breached. - Addison Allred

Multiple businesses in China were using monitoring equipment to collect facial information of the customer in order to identify customers and store their information, etc. In addition, the "face interactive marketing solution" can also provide the service including analyze the gender, age, and mood of a person through photos. – Yilin Zhang

Regulation of Content

As top tech firms continue to take criticism for their lack of management when it comes to "fake news", tech giant Google has decided to contribute $29 million to the European Union's newly established media and information fund to curb misinformation spread online. It must be noted that, so far, Google is the first company to contribute to the fund, but also that Google itself will not participate in any decision making alongside the fund. – Tanmay Ghai

Before, while Steam has been accessible to gamers in China for years, it’s existed in a legal gray area and with significant parts of the platform blocked. After years of uncertainty, Steam China is finally here. It's a version of Steam exclusive to those living in mainland China that only sells games that have been properly licensed by the Chinese government. -- Kaifan Lu

Government use of and access to Data

The NSA has a reputation that precedes itself when it comes to collecting information across the globe, however it faces limitations within its own nation. Moreover, foreign entities have exploited this blindspot and began to use our infrastructure against us. The US government is unable to surveil domestic networks unless a crime is suspected, therefore we are able to see all the dots to connect them - therefore US agencies are looking to combine and tackle this blindspot. - Griffin Weinhold

A new method being used for the first time by the U.S. Census Bureau to protect people’s privacy in 2020 census data could hamper voting rights enforcement and make it harder for congressional and legislative districts to have equal populations, according to a report from two leading civil rights groups.-Yueming, Gao

ICE and CBP have been tapping into the massive vehicle location data stores of GM OnStar, and other fleet monitoring companies. In these cases, it has been shown that these agencies have not only asked for historical data but also live data. Promises of these technologies have created a threat and ensure law enforcement agencies don't get a free pass to access the data whenever they want.

The Locus Charter is not a set of laws or rules, but 10 guidelines meant to steer an organization’s thinking on the ethical use of data. And it asks companies to commit to 10 principles, including minimizing data collection and actively seeking consent from users. It could be the stepping stone to regulations, like California’s Consumer Privacy Act. -– Tian Yang

Ministers in UK are considering forcing Facebook to implement a backdoor to allow security agencies and police to read the contents of messages sent across its Messenger, WhatsApp and Instagram chat services. The legislation will take time to get through parliament and it is unclear how far messaging apps will be covered by the rules. Facebook said end-to-end encryption was “already the leading security technology used by many services to keep people safe from having their private information hacked and stolen”.– Bolong Pan

The UK’s Home Office department is looking into utilizing the technical capability notice for Facebook to integrate a backdoor to its encrypted messaging services such as Messenger, and WhatsApp. These backdoors are cited to assist in making government surveillance requests to help tackle serious user safety issues, that were previously impeded by end-to-end encryption. This topic raises concerns on the use of privacy-preserving technologies, while also protecting those conducting illegal activity on these platforms. – Carol Varkey

The American Civil Liberties Union (ACLU) has filed a Freedom of Information Act (FOIA) request to find out how America's national security and intelligence agencies are using artificial intelligence (AI). The ACLU says the report raised concerns that government agencies may introduce technology that encroaches on a number of rights held by US citizens, including the rights to privacy and free expression. The ACLU also voiced concerns that AI could be used to unfairly scrutinize America's non-white communities. —— Tingyi Guo

Some countries such as China and European Union recently announced their own versions of vaccination passports hoping to regulate international travel and borders. These vaccination passports systems introduce several challenges like inconsistent immunization requirements, unauthorized use, privacy violations, and so on. Governments need to address these problems to prevent the adverse effect of extending the pandemic. – Jia-Yu Lee

Many countries such as Israel, the European Union, the United Kingdom, Japan, and China already use vaccine passports as health certificates. Vaccine passports can be used as a pass to many places, but there are privacy concerns about the data they hold.. – Junbo Sheng

The Health Pass, the mobile technology, shows vaccination results and would be used at on-site conventions, trade shows, and meetings in Las Vegas. Although the ‘Vegas Smart’ are now in place to effectively reduce the risk of virus and allow for safe domestic travel, the experts warn of pushback over concerns on personal rights and privacy. – Yi Lin

The White House and private companies are working on a standard way of handling COVID-19 vaccine credential systems that can track Americans’ health information such as COVID-19 inoculations. Some businesses in Las Vegas only provide service for consumers with health credentials, this way can boost the travel confidence, but not everyone will have the vaccine or want the vaccine, so there needs to be an alternative. - JY(Jinyu) Zhao

As governments and airlines worldwide prepare to issue “vaccine passports” — digital details of a person’s COVID-19 immunization status — critics expressed fears that these digital passes could put sensitive medical and health data in the hands of authorities and law enforcement, endangering the privacy of millions of citizens. - Nana Andriana

Covid-19 vaccination passport might raise ethical concerns such as potential discrimination against those without vaccination and data privacy issues – Yifeng Shi

Sales of Fake vaccination cards are on the rise due to social media. State attorneys general have urged Twitter, eBay and Shopify to mitigate such sales on their platform. People are posting pictures of their vaccination cards on social media that poses the risk of identity theft. Users can use non-identifying methods to show they are vaccinated on social media. - Pratishtha Singh

As campuses around the US are reopening, hundreds of colleges and universities are adopting technologies such as fever scanners, symptom checkers, wearable heart-rate monitors and other new Covid-screening technologies. These tools often cost less than frequent virus testing of all students. Even though these technologies help colleges in showcasing their pandemic safety efforts, their usefulness in identifying possible cases and their effectiveness in preventing the spread are in question. - Arzu Karaer

A viral video shows a doctor accusing the U.S. government of testing out COVID-19 vaccines on the general population and involuntarily entering recipients into a tracking system. The article fact checks the claims made by the doctor and gives proof of how invalid this claim is and what the actual story is. -Supreet Randhawa

Security researchers have seen a spike in listings on dark web marketplaces in recent weeks. The sites are advertising everything from vaccine doses to falsified vaccine certifications and negative test results -- Pratheek Athreya

It is reported that some state's covid vaccine distribution website has less control on the ad trackers and cookies, which are collecting user's data and sending to ad peddlers like Facebook. - Congrui Li

Vaccine-related phishing jumped 26% in a recent three-month period. It shows that criminals adjusted and intensified their campaigns according to real-world news events and public awareness. What's more, they also improved their email tactics to bypass gateways and spam filters. -zheyu ren

CCTV used the show 315, which coincided with World Consumer Rights Day this year, to criticize and accuse several companies of secretly collecting data about their customers using facial recognition. Kohler, among other brands, was accused of installing cameras in stores and capturing the faces of customers to analyze their gender and age, among other details.However, this also caused an uproar on Weibo, as some users reminded everyone that the CCTV also conveniently left out the fact that the Chinese government also has a massive surveillance network of its own. - Phuong Ngo

Chinese regulators have laid out the acceptable range of data collecting for 39 common app types. Many Chinese products ask users to provide more information than needed, like biometrics for payments. Starting May1, the rules will be enforced, like the sweeping antitrust laws introduced earlier. – Zihuan Ran

A Michigan Court of Appeals panel ruled a northern Michigan township could not use drone photos it obtained without a search warrant to prove a resident wasn't complying with zoning rules. The panel ruled 2-1 that the use of a drone to photograph Todd and Heather Maxon's backyard violated the couple's "reasonable expectation of privacy" and Long Lake Township must obtain a search warrant if it wants to take photos. -- Kaifan Lu

You are being tracked or monitored

This story explains how to tell which emails are tracking users. The senders of these emails want to know whether the information sent to the user has been opened. Usually, a tracking pixel embedded in the email is how most people monitor whether the email is open. Once the user loads the hidden tiny single-pixel image, it returns to the base. The easiest way to stop tracking emails is to cancel `Load remote content in emails. If users want further control, they can use extensions in some browsers. – Yansong Wang

A tracking pixel, embedded somewhere in the email, is used to monitor whether and when the receiver opens up the email. Users can disable "Automatically load remote content in messages" in the general email account settings to prevent being tracked. Also, users can use extensions like "Ugly Email" and "Trocker" of chrome to spot tracking emails. -Zheyu Ren

Tesla’s driver-facing camera (“cabin camera”), a part of its driver monitoring system has posed new concerns for driver’s privacy. If turned on, the cabin camera can record and share video clips right before a crash or automatic emergency brake (AEB) that can be used in Tesla’s research for future safety features and other enhancement. This form of the driver monitoring system contrasts those of other automakers and has the potential to be accessed by third parties, malicious actors or for purposes apart from safety research. – Carol Varkey

A recent report has raised questions about the validity of Tesla's in-car cameras, and whether or not they should be seen as a major privacy concern for owners. The article points to the fact that - unlike automakers such as BMW, Ford, GM, and Subaru - Tesla's driver-facing camera is able to record and transmit video footage of vehicle occupants.

Tesla studies footage from cameras within certain Model 3 and Model Y vehicles for research related to its self-driving technology, which prompts questions about consumer privacy. The cameras are turned off by default, but if turned on, Tesla cameras in certain vehicles will collect footage from the moments before a crash to "develop future safety features and software enhancements." – Rosy Zhou

The resort is testing out the new technology from March 23 through April 23, 2021 at the park entrance. The technology takes photo of a guest’s face and converts it into a unique number, which is then associated with the form of admission being used for park entry. - Nana Andriana

Sky Bet, a gambling app in Britain, is being accused of collecting extensive data from its users and using it to extract information about users and also track them in an unimaginable way. The company, along with other gambling apps, is using information to keep players hooked, instead of identifying and helping problem gamblers. Sky Bet claims to not have access to certain records like banking and mortgage date, but it seems to have history of collecting these data and all the relevant information- Phuong Ngo

Data Breaches and Vulnerabilities

The 22 year old Wyatt Travnichek was charged with one count of tampering with a public water system and one count of reckless damage to a protected computer during unauthorized access on March 27. The attack was on the Post-Rock Rural Water District, which Wyatt's elevated access allegedly granted him permission to shut down the cleaning and disinfecting processes of the treatment facility. If indicted, Wyatt could face 25 years in prison and a 500,000 dollar fine for endangering the health and safety of the whole community. -Vartan Batmazyan

The Broward County’s computer system was hacked by criminal gang, and demanded $40 million in ransom. The criminal gang claimed that it would erase all personal data of students and employees unless the ransom was paid. The negotiation between the gang and the county official continued for two weeks, and it was unknown whether the amount was at last paid. – Jiemin Tang

SalusCare's employee has clicked the phishing email that triggered malware to exfiltrate SalusCare's entire database to two Amazon S3 storage buckets linked to the same Amazon AWS storage account. Amazon froze access to the two S3 buckets after being notified. SalusCare requested access to the audit logs of the buckets as part of its investigation but Amazon refused to provide the data as not all the data belonged to SalusCare. After refusal, SalusCare filed a lawsuit against Amazon. This ideally describes that a company using a cloud platform does not have full access to its stored data, as cloud providers have those storages divided among other customers too. - Aziza Saulebay

Cyber insurance firm, CNA which does about 10 billion dollars in annual revenue, confirmed there was a cyber attack against its systems. They do not know what was stolen, but worry the hackers intend on using the attack to orchestrate more lucrative ransomwares in the future. Moreover, the possibility of information being compromised could help engineer even better phishing attacks on policy holders. - Griffin Weinhold

The California State Controller’s Office (SCO) has suffered a data breach because one of the SCO employees clicked on a link in an email he received and then entered their user ID and password as prompted, unknowingly providing an unauthorized user with access to their email account. The attackers can access email and files after a member of the staff clicks on a malicious link and unwittingly shared their credentials. To cope with this kind of phishing attack, SCO decides to install an alert tool within the organization where the employees can report potential phishing emails can reduce the risk of attacks and ensure that the employee is taking the proper actions to protect the organization.- Ye Zeng

This new Zoom breach can be attributed to the screen sharing function provided by Zoom. When a screen share is started for a specific window and another un-shared screen is overlayed on top, there is the possibility that the contents of the overlaid screen may be shared for a moment. If that overlaid page contains PHI, PII, or other information that should not be viewed by the onlookers within the meeting, it can be a breach of privacy and even potentially a violation of HIPPA if in a specific industry. The bug was discovered on 12-2-2020 and a fix has yet to be released for the issue. -Vartan Batmazyan

Some ransomware hackers claimed to have copied source code for a number of CD Projekt’s biggest games. CD Projekt will not negotiate with hackers and was taking the necessary steps to mitigate the consequences of such a release. This attack is emblematic of a growing trend from criminal hackers called "doxware". - Xihao Zhou

There have been increased cyber-attacks in the healthcare industry. Part of the reason is that medical records contain a lot of information about the patient, and the value of such records has grown on the dark web markets. Among the attacks, ransomware attacks account for more than half of the healthcare data breaches in 2020. – Jiemin Tang

Two researchers carried out the first extensive field study to shed light on the issue and to identify exactly which information is being collected when users grant permissions to apps. Thanks to machine learning techniques, these data provide sensitive information such as the place where users live, their habits, interests, demographics, and information about users' personalities. Other information included ones about health, socio-economic status, ethnicity and religion. – Danielle Sim

Simple setting errors became the main factor in cloud exposure. The company or organization does not explicitly restrict who can access the information stored in the cloud but often sets the wrong configuration. The discovery of these vulnerabilities by a mobile security company also makes problems for iOS and Android applications. – Yansong Wang

Apple might be amping up their security and privacy measures for iOS but they can’t control how third parties are storing their user data. Research by Zimperium just shows that nearly 11877 Android apps and 6608 iOS apps use public cloud service like AWS, Azure or Google Cloud with misconfiguration that could potentially, or already expose personal information, passwords and even medical information. These data are just available to anyone because of how the developers didn’t take proper steps to configure the cloud storage. Some companies have been made aware of the problems but not much has change. - Phuong Ngo

Most dating apps/websites have open sourced data available. Open user data provided by online dating sites can be a blessing and a curse. With more people turning to them during lockdown, the risks to privacy are being exacerbated. — Saurabh Jain

A researcher found five similar vulnerabilities in the kernel of Linux operating systems that can allow an attacker to escalate local privileges on a victim’s network. These flaws could allow an attacker to potentially steal data, run administrative commands or install malware on operating systems or server applications. Not just privilege escalation, but also remote code execution are two types of vulnerabilities that can significantly increase the risk to an organization.- Ye Zeng

A new Ponemon Institute and WhiteSource report on application security indicates that most large enterprise-scale organizations feel that their portfolio of applications has become more vulnerable recently.- Shengwang Zhang

Singapore Airline, the second carrier that reported a data breach. It’s not a direct customer of SITA, an air transport communications and IT vendor that originally met the cyber security attack. However, as a member of Star Alliance, a part of restricted data was shared to Star Alliance group, which involved membership number and tier status.– Mingliao Xu

A Turkish actuarial consultancy which analyzes data to help calculate insurance risk and premiums has inadvertently exposed data on 15,000 cases involving people killed or injured in traffic accidents after a cloud misconfiguration. For each of the 15,000 court cases, the researchers found personally identifiable information (PII) and more details of witnesses, complainants and other parties. Cyber-criminals could also use the data to try and bribe officials and blackmail or threaten individuals, it claimed —— Tingyi Guo

About a half million French people’s sensitive medical data has been stolen and leaked online. DataData can be access from multiple sites, includes many personal information like names, phone number and address. So far these files can be found in seven different places online.— Hehan Xie

Covenant HealthCare's login information was being sold on the dark web in addition to employee email accounts compromised by a password spray attack. Social security numbers, driver's licenses, medical records, and more were accessed by an unauthorized third party. -Michelle Muldoon

A hacker is selling over 500 million Facebook users’ phone numbers through a Telegram bot, which allows matching ID and phone numbers for 533 million Facebook users- Shengwang Zhang

Privacy of 1.6 million Washington state residents was recently compromised. In addition to personal data of people who have filed for unemployment claims, sensitive data held by the Washington state Department of Children, Youth and Families are leaked as well. – Kung-Hsiang (Steeve) Huang

A large-scale cyber attack on a PA law firm potentially exposed health information for ~36,000 patients at the University of Pittsburgh medical center. According to the article, hackers had access to patient sensitive data through employee email accounts. A law firm working with the UPMC confirmed that sensitive data such as names, DOB, SSN, financial account numbers, medical record numbers were all potentially leaked and/or accessed. As of now there is no confirmed evidence that the leaked information was misused and what the blast radius or impact of this breach is, although access to the patient data was indeed confirmed – Tanmay Ghai

Hackers stole the personal information of more than 200,000 patients from Nebraska Medicine using malware. Patient information includes medical records, insurance information, and even social security numbers. The good news is that the leaks haven't yet cost patients anything. – Junbo Sheng

A researcher claims to have hacked into internal systems of major companies including Apple and Microsoft using novel supply chain attack whhich included creating malicious node packages and uploading them to npm registry under unclaimed names and these packages collected information through their preinstallation scripts on th

The presence of web shells is one of the strongest signals of an ongoing cyberattack. The hacker can easily use web shell malware to pull data from billions of emails, applications, endpoints, and identities, but it is difficult for the defender to detect. Microsoft’s security team has reported that the shell malware has nearly doubled since last year, and also they pointed out Internal web applications are often more susceptible to compromise due to lagging patch management or permissive security requirements - Ye Zeng

This could prove to be one of the major privacy-related setbacks of the pandemic. Nebraska Medicine and the University of Nebraska Medical Center have begun notifying patients and employees whose personal information may have been compromised in a data security breach last fall. — Saurabh Jain

Two days after declaring potential IPO, the largest cloud service provider in Europe, OVHcloud, has one of its data center on fire. The blaze destroyed one of the four servers sites in Strasbourg centre, damaging another, with the rest two sites shut down for safety. Those clients got affected includes the Centre Pompidou and cryptocurrency exchange Deribit, the France cloud provider has not provided any further comment on potential causes, or if the fire is related to any safety protocols. – Zihuan Ran

A data center of OVH was on fire and millions of websites got shut down. OVH is a pretty important hosting company on the internet. This addressed the data security issue that whether to make a redundant copy of data. -Gan Xin

Disinformation

Lawmakers grilled the leaders of Facebook, Google and Twitter on Thursday about the connection between online disinformation and the Jan. 6 riot at the Capitol, causing Twitter’s chief executive to publicly admit for the first time that his product had played a role in the events that left five people dead. - Nana Andriana

Data Sharing

Uber and Lyft will be sharing information on a pool of driver's personal information to prevent violence and sexual/physical assault of their passengers. It will enable the companies to view which drivers and delivery persons have been deactivated due to this kind of accidents. - Aziza Saulebay

Google

Google Chrome is planning to ditch third-party cookies which will make it far harder for advisers to track the web activities of billions of users. This seems like a big win for privacy and may wipe smaller advertising company out of the business.Also, this move may serve to tighten Google’s grip on the advertising industry.- Sidong Wang

An antitrust lawsuit against Google which focuses on Google's advertising tech has been updated because Google plans to block third-party tracking cookies in Chrome by 2022. The lawsuit accuses that the move would be against the interests of smaller publishers such as local newspapers. However, Google thinks the lawsuit mischaracterizes many aspects of their business and argues that privacy advocates, advertisers, and their own rivals are welcomed to the steps Google is taking with the Privacy Sandbox. - Yi Jin

The new Google Nest Hub will track users' body activity in bed to generate personalised sleep-tracking reports. Google said the new features had been "built with privacy in mind”. People still are concerned about the exploitation of personal data. – Jia-Yu Lee

Google has protected users’ info very well and almost none is exposed to public during these years. Google abandon tracking third-party cookies while shifting to a privacy-focused first-party data model. As consumer expectations for privacy rises, Google believes solutions that use personal identifiers are not a sustainable lone-term investment.– Bolong Pan

Google claims that it won’t use any new identifiers made by third parties. The company is working on protect anonymity while still delivering results for advertisers and publishers. This new ad policies reflect a changing industry -- and a potential move to sidestep government regulation. – Rosy Zhou

Google announced that third-party cookies in Chrome will be removed while a new technology that considers groups of users' data without users' individual identifiers will be used for advertisement. -Gan Xin

A Data Protection Impact Assessment published by Dutch data protection authorities anounced that the data handling in Google Workspace contains “ten privacy risks” and lacks of transparency of how data was processed by Google. Problems including potential legal gray areas surrounding both the tech giant and

Google is striving to implement stricter policies in regards to their users' privacy due to the backlash and lawsuits that have been filed against them. Google wants to make their data that they collect be more anonymous, and release lease personal level data to advertisers. Google will also no longer try and support as many cookies as they currently do during the second quarter of the fiscal year. – Addison Allred

A group of US states has extended an antitrust complaint against Google, addressing its move to a new advertising tracking method.The plaintiffs- 13 states and the Commonwealth of Puerto Rico have taken issue with Google's plan to replace third-party cookies in Chrome, crashing the move as cementing approach that forces advertisers to do business with Google.The refreshed complaint argues that, whilst Google’s latest update may enhance privacy for users, it could also push more advertisers to rely on Google’s suite of ad products, thus reinforcing the company’s grip of the market – Lei Gao

Other, e.g. Security Technologies

Recently, Netflix has introduced trial measures to try and prevent the practice of password sharing with multiple households. In the trial, users can verify if they are eligible to access a particular account according to Netflix's terms of service, via a code sent via text or email. Jake Moore, a cybersecurity specialist at ESET, said: it is unrealistic to expect that people are going to stop sharing their accounts completely, so my advice would be to regularly change your passwords in order to flush out anyone who has gained access over the last year who shouldn't have. —— Tingyi Guo

Non-fungible tokens, built on the Ethereum blockchain, are a way to prove ownership of digital art and collectibles. But what happens when the file, storage solution, or issuing organization is taken offline? How does the NFT prove ownership if the location of the asset changed? This article calls for a standard on how NFT media is permanently persisted to resolve data ownership.

A website MyHeritage launched a “Deep Nostalgia” tool to create realistic deepfake animations from images. The tool is designed for getting an idea of what a person might have been as a living human being from an old photo. However, using this tool may also cause exposure to data privacy. – Haonan Xu

Remote Learning

The education space has become a major target for cybercriminals. CISA and the FBI recently issued a joint statement warning K-12 schools of worsening dangers in 2021 after a recent 57% spike ransomware attacks in the sector. – Rosy Zhou

Apple

An internal document from France's data regulator seen by POLITICO revealed Tuesday that the iPhone maker’s targeted advertising practices may fall afoul of the European Union's privacy laws. Although French regulators gave a thumbs-up to the feature called Apple’s App Tracking Transparency, the privacy watchdog gave the iPhone maker's own ad business a more damning assessment. The National Intelligence Commission (CNIL) believes that Apple’s advertising process involves reading or writing data on the user’s device, which requires consent, but Apple’s current practice shows a lack of consent. –Yixiang Cao

There has been a huge wave of sharing vaccine card on social media recently, which poses significant security and privacy risks, warned by multiple government agencies. The card contains a combination of sensitive personal and medical information, including name, date of birth, medical record number, vaccine lot number, clinic location and the brand of vaccination received, which provides a breeding ground for identity thefts and phishing. A cybercriminal could, for example, attempt to call your healthcare company to learn about your medical history or diagnoses, cancel upcoming procedures, change prescription doses and more. — Haipeng Yu

China's big tech companies such as Tencent and ByteDance are working to bypass some of Apple's new privacy policies in order to continue their tracking of iPhone users for targeted advertising. In recent times, Apple has released new legislation to give users more "privacy", and a part of that is a permission/opt-out feature for when they are allowed to track data. As a response, the China Advertising Association has launched a new tracking initiative called CAID and is backing ByteDance, in particular, to help them continue to track users with this workaround. – Tanmay Ghai

The company has joined forces with dozens of Chinese trade groups and tech firms working with the state-backed China Advertising Association to develop the new technique, which would use technology called device fingerprinting, the people said. Dubbed CAID, the advertising method is being tested through apps and gathers iPhone user data. Through the use of an algorithm, it can track users for purposes of targeting ads in a way that Apple is seeking to prevent.— Saurabh Jain

Apple’s new App Tracking Transparency framework will soon require apps that use ad tracking to notify users and collect affirmative consent. If the user opts out, the unique device identifier for advertisers (IDFA) cannot be used. Though circumventing these new privacy rules with similar identifying techniques can get one banned from the app store, major Chinese tech companies appear to be discussing just that out in the open.- Shengwang Zhang

Apple wants to enforce user privacy regulation of apps. Chinese tech companies usually create device identifiers via "set Device Name". Apple wants to stop them from creating device identifiers. Chinese tech companies create a new way that create identifiers in the cloud, then create parameters in the device. It likes a cat-and-mouse game. - JY(Jinyu) Zhao

With Apple's new privacy restrictions that it will place with iOS 14, Facebook pushes back against the restrictions that it will place on Apple devices. The main privacy restriction that Facebook is against is Apple requiring that users must agree to give Facebook access to their location. Facebook claims that this will hurt their business model of promoting to small businesses in particular since they will no longer be able to identify what small business companies are currently closest to the user if they don't have the users current location. - Addison Allred

Despite being only recently released, there is already a piece of malware similar to Pirrit that is able to infect the device. Despite being a natively x86 compatible malware, it has been modified to run on the M1's ARM architecture and allow the download and install of unwanted applications ie the GoSearch22 adware. Although GoSearch22 has had its certificates revoked, it had the ability, when valid, to disguise itself as a legitimate browser and collect browsing data as well as pop up random advertisements and download more malware. This is the first of what is likely to be many compromises of Apple's newly designed CPU. -Vartan Batmazyan

Facebook CEO Mark Zuckerberg said that the privacy update to iOS 14 will help Facebook to be on a good position by their new commerce products. Facebook used to announce that updates on iOS 14 lead to a more than 50% drop in its Audience Network advertising business. – Congrui Li

• The privacy labels of some Apple apps were found to not accurately represent the information collected, tested by a number of media sources
• The main issue is due to apple's not checking each and every app submitted to the store for compliance
• It seems like Apple’s new privacy labels may rely strongly on “community policing” to be truly effective, if not properly handled
• Haipeng Yu

As discussed in lecture, security mechanisms are what realize security policy. In its most recent patch notes, Apple disclosed an 'arbitrary code execution' bug. This kind of flaw allows hackers to bypass security mechanisms and unfortunately it was seen 'actively exploited'. – Francisco Ventura

APPLE store requires application manufacturers to list labels to indicate how the application will use the collected data to process customer information, which will also cause confusion for other applications. How to Read Apple’s Privacy Labels become important. – Jinglun Chen

Apple decided to release a new feature called App Tracking Transparency(ATT) in "early spring". This will require apps to ask for users' permission in order to track them around the web. Facebook said Apple was pushing for "anti-personalized ads and will take the world back 10 or 20 years", they believe "ATT" will kill small businesses by preventing them from advertising to would-be customers. Also, Facebook targets a number of other features of IOS that are applied unfairly. A new set of "privacy nutrition labels" requires Facebook to list the types of data it collects while apps provided by Apple like iMessage do not display the same info. - Xihao Zhou

The new Apple IDFA terms will soon require apps that use ad tracking to notify iPhone and iPad users and obtain consent via a pop-up.That appears to be the tack that Facebook is taking. And Facebook started rolling out the messages to users of the Apple Facebook and Instagram apps on Monday – Hehan Xie

The story explains different views of executives of Apple's big tech buddies on Apple’s new privacy updates which mandate that apps ask for permission to track user behavior. Executives of Facebook and Snap were pretty much down with the privacy, while Twitter claimed the changes could have a modest impact and Google kept silent on it. - Yi Jin

This is a follow-up of my last news about Apple's App Tracking Transparency(ATT). Facebook will display a new pop-up screen to encourage users to agree with their data tracking policy. Apple will allow users to control what data each app collects and switch it on and off at will. - Xihao Zhou

Red Team X, founded in the spring of 2020 and led by Ionescu. The Red Team X mission speaks directly to trying to secure the supply chain for Facebook, and the scope is to look at the security of pretty much anything that would be consequential to Facebook as a company. The internal hacking team has spent the last year looking for vulnerabilities in the products the company uses, which could in turn make the whole internet safer. -– Tian Yang

Facebook

Facebook forces users to do a Facebook login when they use oculus headsets. Facebook will collect users' data via those headsets, and then use the data to target relevant ads to users. From my point of view, Facebook should show more respect to user privacy. - Jinyu Zhao

Facebook’s Oculus Quest 2 requires a Facebook login, and agreeing to Facebook’s terms of service for the device. Facebook confirmed that users' activity on an Oculus device, such as which apps users use, will be used to target “relevant content” to users, for example ads or Facebook events. -- Kaifan Lu

Social Media and Other Apps and Privacy

The story talks about French privacy watchdog CNIL has opened an inquiry into Clubhouse’s handling of user data. As a live-chat app, Clubhouse has some practices that may violate privacy laws. For example, the app requires constant access to user contact lists and keeps the content of private live chats without the agreement of users. The Clubhouse is extremely likely to face fines and sanctions because the data of EU citizens it processes and stores are protected by GDPR privacy laws. - Yi Jin

Clubhouse seems like the new 'it' thing. The invite-only app has been in news since last year and it's only been growing ever since. Last summer, it had just a few thousand users, mostly Silicon Valley tech workers and venture capitalists who wanted to connect with one another during the pandemic. Today, it has millions of users, a valuation of roughly $1 billion, and a ton of buzz. Both the Tesla chief executive Elon Musk and the Facebook head Mark Zuckerberg recently appeared on Clubhouse, causing such a stir that the platform nearly crashed. But as Clubhouse continues to expand, its security and privacy failings have come under increased scrutiny—and left the company scrambling to correct problems and manage expectations. -Supreet Randhawa

Conversations are not recorded but a third party website or hacker/scraper without joining into a chatroom streamed into multiple chatroom (this is beyond just through different devices). It can be scary when someone is eavesdropping into sensitive conversations. You can assume that your chats can be recorded. - Pratishtha Singh

As a fast-growing social media platform, there are still many concerns about Clubhouse, including mishandling user data, the uncontrolled purpose for audio rooms, etc. – Congrui Li

With the explosive growth of the audio-based social media app Clubhouse, privacy concerns also merges with it. Including transmitting users' identifiers and identity numbers unencrypted, further revelations followed that Clubhouse discussions were being scraped for an unaffiliated Android app, allowing Android users to listen along in real-time. Researcher also believe that Clubhouse hasn't given adequate thoughts to its security issue because it does not offer end-to-end encryption to its users.- Chengyuan Zhou

While clubhouse has been growing rapidly and gaining more and more users, some privacy and security issues have also emerged. The servers might be monitored by the governments, Clubhouse asks for access to users’ entire contact lists, and many other concerns are associated with the application. – Jiemin Tang

Clubhouse, a recently popular audio-only social network app, raises some concerns about user privacy information. Clubhouse uses an invite-only mechanism to obtain users. It will also grab your contact information for those who aren't members yet. – Yifeng Shi

Clubhouse is an audio-based app that allows users to create and join rooms where all kinds of topics are discussed. If you didn’t give Clubhouse access to your contacts, Clubhouse still has made it possible for them to know anyway, encourages them to follow you. It’s not clear why Clubhouse doesn’t have better options for users to manage their privacy or more information for users about how their data might be used or linked to them.

Clubhouse, a fast-growing, invite-only app on iPhone, seems to be taking users’ contact data further than the norm. The article explained how Clubhouse uses your personal data in a creative and a little creepy way. By uploading your phone’s address book, you will be able to see a list showing you how many “friends on Clubhouse” each of those people already has. – Yilin Zhang

Grindr, Hinge and Halo among many other apps and tech gadgets were tagged 'Privacy not Included' label by the report. The report looks through data collection policies and security posture of 24 dating apps including Tinder and Bumble in the V-Day edition. Dating apps, especially Grindr and POF, are deemed as privacy nightmare since they share biometrics and personal information collected with third parties. - Phuong Ngo

To communicate with others, some people turn to social media, while others use the social networks to take a break from their everyday lives or vent their frustrations. Social media is now playing a part in politics more and more. The channels are now used by politicians, advocacy parties, policymakers, and more as a way to communicate with voters and spread their message. -Supreet Randhawa

Many O.G. usernames on Instagram are stolen by hacking, extortion, blackmail and harassment and been sold. Instagram is coordinating with Twitter and Tiktok to ban this users who are involved in stealing.– Congrui Li

This news tells us about people exposing most of their information over social media making it easier for hackers to do social engineering. The readily available information on social media is being used to do phishing or online fraud. - Aziza Saulebay

Grindr has been fined by the Norwegian Data Protection Authority for sending location and tracking data to advertising companies without user consent. This not only violates European policy, but has dangerous implications for users in countries where homosexuality is illegal. The sanctions will hopefully emphasize the need for dating apps to acquire consent before sharing sensitive user information. - Brianna Heffernen

An Ontario judge has dismissed one proposed class-action lawsuit against Facebook related to the Cambridge Analytica privacy breach, while a second, broader claim remains outstanding. The data breach came to light in 2018 and exploded into a worldwide scandal, and law firms filed class-action lawsuits, including a handful on behalf of Canadian Facebook users. But justice ruled that the plaintiff had no proof that any Canadian user’s data was shared with the British firm. –Yixiang Cao

WhatsApp shares it's new privacy plan clarifying that it does not share personal chats of people to facebook, businesses have the option to use "secure hosting services from Facebook to manage WhatsApp chats with their customers, answer questions, and send helpful information like purchase receipts. - Pratheek Athreya

Facebook plans to have WhatsApp reimplement privacy policy that allows any interaction with businesses on WhatsApp to influence the ads targeted towards you on Facebook. Users have been urged to read the privacy policy since there was miscommunication that Facebook planned to take more data from a user's WhatsApp activity. Rather, they plan on using existing data they have extracted from WhatsApp to generate better ads. Because user's originally believed that it was infringing upon more of their personal data, they began turning towards alternative messaging apps. – Addison Allred

Whatsapp claims that it does not have access to its users private communications but they released a new policy in January that needed its users to agree to its new policy to continue using whatsapp. After facing a lot of backlash due to it, they are planning to re-introduce the updated privacy policy in the coming weeks. The new policy will address people's concerns and the role Facebook plays with whatsapp's data. It is still suspicious that Facebook claims that they get no data from whatsapp whatsoever but there is a usual distrust when it comes to Facebook; given its background. - Pratishtha Sing

WhatsApp made a new announcement, which explains how users can learn about their privacy policy. The new policy focuses on treating business-user message and user-user message differently. The goal of this new policy is possibly to address the rising concerns of WhatsApp sharing data with its parent company, Facebook. – Zihuan Ran

WhatsApp published its new terms and conditions. And users are obliged to accept this if they wish to continue using WhatsApp after February 8 2021. In this new term, Facebook would be having access to millions of user information from WhatsApp. Some countries such as India have filed a petition against WhatsApp saying it is jeopardizing national security. GDPR applicable countries will receive a privacy policy because GDPR is one of the strictest in the world. Therefore, it is not too late to act, and introduce sound privacy legislation now to ensure that app providers have meaningful, clear terms and conditions that will allay doubts and suspicions in the minds of the user. —— Tingyi Guo

Italy ordered Tiktok to block access to users whose age cannot be confirmed. The temporary ban comes after the death of a young girl will last until 15 February. Italy also asked other social networks for clarification on children policy.– Jia-Yu Lee

Internet of Things

As the surveillance model with emergency service unit and bomb squad, the New York Police Department’s Digidog brings privacy concerns to the public. This new technology model has raised concerns about its improper use which causes bias, mobile surveillance, hacking. Last year, the city council passed the Public Oversight of Surveillance Technology Act offering regulation on the kinds of surveillance and technology techniques. The Act asks the Police Department to be more transparent for such Digidog robots. – Yi Lin

AI and Big Data

Training AI models would be one of the strongest solutions to protect data privacy. It is an effective and relatively simple solution. The AI model will anonymize personal data by removing all data identifiers while still available for the companies to analyze the population. – Haonan Xu

Cryptocurrency and Blockchain

Some progressive lawmakers proposed an alternative way of distributing stimulus relief check as digital dollars, which requires no extra printing or physical dollars. But this also brings the privacy issue that the transactions will be visible to the companies involved and even government or law enforcement. - Chengyuan Zhou

Other

A secretive start-up scraped the internet to build a facial-recognition tool, it tested a legal and ethical limit and blew the future of privacy in America wide open. Although this has caused people to worry about privacy, Clearview can also be used in many areas that are beneficial to humans, such as the rescue of children. Massive data can accurately identify children. Both the Navy and the Army are its customers, and the more images that can be captured, the better the results.– Jinglun Chen

Napa Valley neighborhood group sues hot air balloon business for invading privacy. They advocate that thousands of people can see directly into private homes/backyards every day. Currently, the business is allowed to fly up to 8 balloons daily for 225 days a year. -Michelle Muldoon

If you do not pay of the product, then you are the product - this quote of the social network really excited me and this NYT article also had a similar gist. Because of how personal data is shared, “there could be thousands or hundreds of thousands of companies that have data on you,” said Stacey Gray, senior counsel at the nonprofit Future of Privacy Forum. “Users, however, typically do not change their default settings even when it means their data is being collected.” — Saurabh Jain

There are new browsers that minimize the data that is gathered about us by blocking tracking technologies and by not recording the browsing history. The web history is deleted when you close the browser. Brave, DuckDuckGo and Firefox Focus are examples of these browsers. - Arzu Karaer

A new type of Internet navigator called a dedicated browser, from well-known brands such as DuckDuckGo and Brave, has appeared in the past three years. What stands out is that they minimize the data collected about us by blocking the technology used to track us.This type of browser usually turns on private mode by default, or automatically clears the browsing history when you exit the browser, and also has built-in tracking prevention features, which allows them to actively block trackers using methods that minimize website damage . – Jinglun Chen

Some companies and apps are making trades with users to get the consent of collecting extra privacy data while providing some discounts of services fee. The author used the instance of an auto insurance collecting customers’ driving habits and giving discounted insurance rates. Although customers and users are expecting their privacy being well protected and limitedly collected, they can’t resist such financial temptation and sell their privacy cheaply. Even most users give privacy consent just because they can’t get rid of the conveniences from the services. – Lingyu Ge