STE WILLIAMS

Hackers say they will leak patient and employee records stolen from a Canadian healthcare provider unless they are paid off.

The records include medical histories and contact information for tens of thousands of home-care patients in Ontario, Canada, and belong to CarePartners.

The biz, which provides home medical care services on behalf of the Ontario government, admitted last month that it had been hacked, and its documents copied. At the time it only acknowledged that personal health and financial information of patients and employees had been “inappropriately accessed.”

A gang claiming to be behind the network intrusion then approached CBC News with a sample of the swiped data. That bundle reportedly included thousands of patient medical records with phone numbers and addresses, dates of birth, and health card numbers, as well as detailed medical histories including past conditions, diagnoses, surgical procedures, care plans and medications for patients across the Canadian region.

A separate document supplied by the miscreants contained, we’re told, 140 active patient credit card numbers and expiry dates, many with security codes. Samples of snatched worker files were also offered.

Medic! Orangeworm malware targets hospitals worldwide

READ MORE

The crooks boasted they are sitting on a cache of hundreds of thousands of such records dating back to 2010, and are demanding money to keep a lid on the files. “We requested compensation in exchange for telling them how to fix their security issues and for us to not leak data online,” the cyber-fiends said.

CarePartners bosses said they are working with the Herjavec Group, a cybersecurity firm, to investigate the hacking. It declined to comment further due to an ongoing probe by Waterloo Police into the matter.

In the meantime, it is working with Ontario’s health integration networks (LHINs) — provincial government agencies that contract out home-care services, such as nursing, to commercial firms such as CarePartners – in notifying affected patients and other parties.

Data privacy watchdogs at the Office of the Information and Privacy Commissioner of Ontario said they were “assessing whether the breach could have been prevented, whether adequate steps are being taken to respond to it, and to ensure that systems are in place to help prevent future breaches,” CBS News added. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/18/carepartners_data_breach/

Security biz Kromtech has unearthed two more embarrassing – and potentially dangerous – cases of groups leaving mass data caches unguarded on the public internet.

In the first case, the culprit was an improperly configured AWS S3 bucket owned and operated by Robocent, a political robocalling company based in Virginia Beach, VA.

According to Kromtech head of comms Bob Diachenko, the storage bucket contained 2,594 files, including the audio files to be used in robocalls to voters and spreadsheets containing the voter data itself.

Among the info the company was holding was voters’ names, addresses, year of birth, phone number, political affiliation, and demographic info like ethnicity and education level, all pieces of data that would be valuable to use in a spear phishing or social engineering scam.

Unfortunately, Diachenko said, it gets worse. It appears other sites have already collected and indexed the exposed data.

“What’s more disturbing is that company’s self-titled bucket has been indexed by GrayhatWarfare, a searchable database where a current list of 48,623 open S3 buckets can be found,” Diachenko explained.

The second case exposed by Kromtech could land a few people behind bars.

Millions of scraped public social net profiles left in open AWS S3 box

READ MORE

Researchers uncovered an exposed mongoDB instance that contained both credit card numbers and payment details. A bit more digging lead the researchers to a dump of Facebook and stolen email account information and info from freemium games that offer in-app purchases through virtual currency.

Eventually, the researchers were able to piece together what was going on. The stolen credit cards were being combined with the lifted data to set up Apple IDs on hundreds of jailbroken iPhones that could then be automated to create user accounts on installations of the free-to-play games. The fake game accounts then purchased in-app currency for the games and were re-sold to other players for cryptocoins or real-world currency.

In other words, the scammers were using fake game accounts on jailbroken phones to launder money from the stolen payment cards via the freemium games, and the criminals operating the scam had left the entire operation wide open to the public by not securing the database.

Kromtech said it had reporting all of its findings to the US Department of Justice so that a criminal investigation could be opened. ®

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/18/kromtech_open_buckets/

Training and response is the basis of a new offering that addresses ransomware and extortion attacks.

Ransomware’s rise to the top of the malware charts shows no signs of slowing, nor has preparation by security executives for such an attack. Now a new service promises both response and training assistance for companies girding for the worst.

The Flashpoint Threat Response Readiness Subscription includes training on what to do when a ransomware or extortion attack hits and negotiated rates for professional services when an attack actually occurs. “Some customers have been asking for this for some time, [while] others, at first blush, say that they don’t need it,” says Tom Hofmann, vice president of intelligence at Flashpoint. “When we talk through some of the incidents, though, then there’s a strong demand to learn more.”

In particular, attacks based on extortion — when a threat actor exfiltrates information and threatens to reveal the contents if money is not paid — falls outside the playbook of most organizations, Hofmann says. And it’s a playbook that has pages covering more than the IT security organization. “We work with legal departments, outside counsel, the PR team — we’ve seen cases where malware hits, corporate systems are locked up, and corporate employees were taking pictures with their cellphones and tweeting it out,” he says.

Planning is crucial, Hofmann adds, because “this is where cyber blends with the business.” In addition, stress is added because all teams will be in full incident-response mode — typically a poor time to be developing policies and processes to deal with an issue.

The subscription is intended to help companies understand the malware, understand the options for responding, and decide whether there’s a cyber response in addition to the business response. The Flashpoint Threat Response Readiness Subscription is available now.

Related Content:

• How to Structure an Enterprise-Wide Threat Intelligence Strategy
• Reactive or Proactive? Making the Case for New Kill Chains
• Ransomware vs. Cryptojacking
• 5 Tips for Integrating Security Best Practices into Your Cloud Strategy

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/new-subscription-service-takes-on-ransomware-protection/d/d-id/1332322?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

In the public sector and feeling overwhelmed? Focus on the basics, as mind numbing as that may sound.

Cybersecurity is a fast-moving target, particularly in the public sector. With constantly changing mandates and compliance requirements, it is hard to keep up. Since the Office of Personnel Management compromise in 2015, government security leaders have been in overdrive trying to strengthen their organizations’ security measures to stave off the next major breach. This focus on cybersecurity in the public sector has also made the “government needs to be more like industry” cry louder than ever. Unfortunately, it is also more wrong than ever.

I know this because I routinely hear from and ask questions of security leaders from both commercial and public sector organizations, and the top problems are categorically identical: talent recruitment and retention, skills gaps, budget challenges, and a constant stream of new threats for which to look out.

The hard truth is, despite 30-day cyber sprints, creating a promising Continuous Diagnostics and Mitigation Program, acquiring the latest tech and checking off every other “best practices” box, we are playing catch-up with our adversaries. And we will continue down that path until we change tack.

What is the solution I offer to end your adversarial woes? First, discard that question. Your route to success: Go back to basics and roll up your sleeves.

You Can’t Protect What You Can’t See
Past midnight, a beat cop comes upon a chief information security officer (CISO) on his hands and knees under a bright street lamp. The CISO is searching the road for dropped keys. After 30 fruitless minutes of assisting with the search, the impatient officer asks, “Where did you lose them?”

“Over there,” the CISO says, pointing at a darkened alley, “but the light’s much better here.”

I won’t win any plaudits for this pearl of wisdom: You cannot secure that which you cannot see. Nor for this: What you need to secure may not be where you’re looking. Before you nod in obvious agreement, check in with your security operations centers. Do they lack visibility across the IT, network, cloud, and security infrastructure stacks? To paraphrase Donald Rumsfeld, how would they know their unknown unknowns?

“But,” you answer, “I have visibility and monitoring tools… a dozen of them!” Do those tools give you a holistic view of your infrastructure? Have you evaluated both gaps and overlaps or duplicates? Is your infrastructure complete but fragmented?

By the time you piece together that puzzle, has your environment changed? In my experience, dealing with a tangled mess of wires in a data center is more appealing than facing the answer to those questions. I’ve been there.

Identity Matters
How do you begin to sort out your data? The most critical step is starting with a thorough risk assessment of your practices by asking the boring but right questions. For starters:

• Where is your data?
• Who and what have access to that data?
• How complete is your inventory?
• How thorough is your configuration management database (CMDB)? How up to date is it?
• Are you seeing what is necessary or simply what is convenient?

Also, determine what success looks like for your agency. Is it enhancing the way you collect and use data to guard against inbound risks? What level of breach or compromise are you comfortable with? This last question is one I find most people hesitant to address but perhaps is the most significant.

This work is tedious. It looks less like vendor dinners or rolling out a new tool and more like listening to your team, comparing notes with other CISOs, and reading, learning, doing. But I promise it will be worth the work, and even more, now is the best time to be conducting this effort. Your success is in the excellent delivery of monotonous tasks.

Artificial Intelligence and Machine Learning Can Help
Once your agency has determined its goals and figured out what you can see and need to protect, it is time to put your talent into action, define your tactics, and finally line up supporting technology.

Remember that CMDB? Now that the grunt work is complete, your confidence in it should be higher than ever and well placed. The law of entropy assures us that the universe tends toward chaos. A massive expenditure of energy is needed to halt and reverse that natural degradation. That brute force and total commitment to the rudiments and fundamentals will buy you breathing room to deploy scripting and automation to hold the new line.

Now you have a path to those shiny artificial intelligence (AI) and machine learning (ML) tools you’ve been eyeing. When they are properly deployed, relying on the solid foundation established by your earlier diligence, you may find those tools will even help alleviate the stress on your overworked security team. A refreshed and re-engaged security team focusing on higher-order questions and problems is a game changer you’ll not soon forget.

But AI and ML are only as good as the data you can provide. That’s why the tedious stuff is imperative — so the fun stuff can be even more fun.

Act Now 
I know there are a lot of people in both the public and private sectors who will read this and say “Obviously.” But I also know there are more who will get nervous thinking about how much mind-numbing work I just prescribed. I would remind both of the truism: Well done is better than well said.

Because again: I’ve been there. In fact, I’m still there, because the nature of security is never-ending and there is always more to be done.

Related Content:

• The Best and Worst Tasks for Security Automation
• Security Compliance: The Less You Spend the More You Pay
• Is Public Sector Cybersecurity Adequate?
• Redefining Security with Blockchain

 

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Register before July 27 and save $700! Click for more info. 

Joel Fulton, Ph.D., is Chief Information Security Officer for Splunk, leading the Splunk Global Security teams, where he also supports product development as well as customer and partner relationships. Prior to joining Splunk, Joel held security leadership positions at … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/make-security-boring-again/a/d-id/1332323?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Whether running on iOS or Android, Facebook’s and WhatsApp’s messenger apps present a ‘winning’ combination.

The enterprise is still full of risky apps, but, according to a new report, WhatsApp Messenger and Facebook Messenger are the riskiest. Those two present the “winning” combination of high risk and great popularity, whether the platform under scrutiny is iOS or Android.

The “Enterprise Mobile Security Pulse Report” for Q2 2018 is based on scans that mobile security provider Appthority performed for enterprise customers. The report looks at the combination of app risk factor and app presence in the enterprise to come up with a total risk score.

The two messenger apps are also among the most commonly blacklisted apps among enterprise IT groups, with most listing the risk of data leakage as the main reason for keeping the apps out. Notably, the concern for data leakage wasn’t simply for sensitive information being sent by employees; companies also listed data including location and contact lists as information they considered proprietary.

The report details the 50 riskiest apps on both iOS and Android devices.

For more, read here and here.

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/mobile/messenger-apps-top-risk-hit-parade/d/d-id/1332324?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Here’s #2 of this week’s Security SOS Week podcasts, right here #ICYMI.

In this episode: No website is out of the reach of cybercrooks, so web security is vital – but how to get it right?

Join us as we talk to Sophos Naked Security’s very own website guru, Mark Stockley, an expert who not only understands web security but also has a special gift for making this treacherous topic both clear and interesting.

If you enjoy our podcasts, please share them with other people interested in security and privacy, and give us a vote on iTunes and other podcasting directories.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/8s0IL21dpkA/

In the aisles full of head-scratching products being shown off at the massive Consumer Electronics Show (CES) in January, this “magic money-making machine” – that was supposed to be a bitcoin-mining computer – earned the dubious honor of being dubbed the WTF of the day:

Here’s a photo of Kodak’s magic money making machine. https://t.co/wjWeJqMUBF

—
Chris Hoffman (@chrisbhoffman) January 09, 2018

How to sum it up? Really, Ataraxia Investments did the best job:

@chrisbhoffman #kodakcoin #Bitcoin #CES2018 #Kodak https://t.co/O38FYzS6cz

—
Ataraxia Investments (@Ataraxia_Invest) January 10, 2018

It was immediately labelled a scam. Now, the company behind it (which, it turns out, was not Kodak; rather, it was a Kodak licensee called Spotlite USA) has thrown in the towel on what people found to be an “astoundingly stupid” idea.

The thing looked like it was branded by the Eastman Kodak Company, which kind of, sort of made sense, given that the venerable, 138-year-old imaging technology company, which declared Chapter 11 bankruptcy in 2012, had been scrambling for reinvention and relevance for a while.

One of its we-still-matter plans: At the same time KashMiner reared its kashy head, Kodak launched KodakCoin, a “photocentric cryptocurrency to empower photographers and agencies to take greater control in image rights management.”

But Kodak told news outlets that KashMiner was never officially licensed. It also never officially made any sense according to those that got a look at the KashMiner brochure:

@chrisbhoffman 😂😂 https://t.co/AJiPSgbTqZ

—
Ralph Pugh 🇺🇸 (@PughRalph) January 10, 2018

As BuzzFeed News’s Ryan Mac described it at the time, according to the brochure, customers would cough up $3,400 to rent a KashMiner and would receive a payout of about $375 per month for the next two years if bitcoin averaged a price of $14,000 in that time frame.

The brochure noted that the licensing company would take in 50% of the cryptocurrency mined, while paying for insurance, maintenance, and electricity (bitcoin mining is extremely power hungry) while they are reportedly stored at Kodak’s Rochester, New York headquarters.

Wrong, wrong, wrong, experts more or less instantaneously said. On so many levels.

Besides the fact that Kodak says KashMiner was never officially licensed, the hundreds of devices that Spotlite CEO Halston Mikail said would be installed at the Kodak headquarters in Rochester, New York – to take advantage of cheap electricity offered by an on-site power plant – never materialized.

But more important than all those logistics was the project’s reflection of a fundamental ignorance of basic principles of cryptocurrency. Saifedean Ammous, an economics professor and author of The Bitcoin Standard, pointed out at the time of KashMiner’s debut that the bitcoin protocol only releases a fixed amount of cryptocurrency each day. The more miners jump into the fray to compete with each other, the harder the computations get, and the more power they require.

Nicholas Weaver, a lecturer at the University of California, Berkeley, told BuzzFeed News that this basic cryptocurrency principle makes KashMiner’s premise – i.e., that computing speeds (known in the cryptocurrency world as “hash rates”) would remain the same – “ridiculous.”

This is how basic cryptocurrency protocol worked out in the real world during the six-month period leading up to KashMiner’s release, Weaver said:

Over the last six months, as more people have started to mine bitcoin, the hash rate has more than doubled, meaning you receive half as many bitcoins for the same amount of computing power.

A Kodak spokesman told the BBC that the project never got off the ground:

While you saw units at CES from our licensee Spotlite, the KashMiner is not a Kodak brand licensed product. Units were not installed at our headquarters.

Another snag: as Spotlite’s Mikail told the BBC, the US Securities and Exchange Commission (SEC) put its foot down, krushing the KashMiner’s krazy KryptoKrunching scheme.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/1-AOZMqB6Qw/

Luminosity Link: it’s a legitimate tool for Windows admins to “manage a large amount of computers concurrently,” its marketing claimed.

Oh, come on, developer, don’t be shy: Luminosity Link was actually a cheap, easy-to-use, multi-purpose pocket knife with a slew of malware tools you could flip out. In reality, it was a remote-access Trojan (RAT) that could be surreptitiously installed without a user being aware, that disabled anti-virus and anti-malware protection on targets’ computers in order to stay that way, and then went to work switching on webcams to spy on video feeds; accessing and viewing documents, photographs, and other files; stealing passwords; and/or installing a keylogger to automatically record victims’ keystrokes.

Crooks could also use Luminosity Link – also known simply as Luminosity – to mine cryptocurrency on infected systems with stolen electricity and CPUs, as well as to use the infected systems to launch distributed denial-of-service (DDoS) attacks.

All these capabilities are outlined in a plea agreement signed by a 21-year-old man from the US state of Kentucky who on Monday pleaded guilty to being the tool’s developer.

Colton Grubbs pleaded guilty to federal charges of creating, selling and providing technical support for the RAT to his customers, who used it to gain unauthorized access to thousands of computers across 78 countries worldwide. Grubbs also pleaded guilty to trying to hide incriminating goodies.

According to the plea agreement, on 10 July, 2017, after learning the FBI was about to search his Lexington apartment, Grubbs gave his laptop to his roommate and asked him to conceal it in the roommate’s car.

Grubbs also called a PayPal user who was collecting Luminosity payments on his behalf – PayPal had banned him for selling malware – and warned him to “clean your room.”

Grubbs also hid a debit card associated with his bitcoin account in a kitchen cabinet; tucked a phone storing his bitcoin information away in his roommate’s closet; spirited away the hard drives from his desktop computer, removing them from his apartment before the search; and then, three days later, shuffled over 114 bitcoins from his Luminosity Link bitcoin address into six new bitcoin addresses.

In February, Europol announced that the purportedly “legitimate” Luminosity tool had been snuffed out. The shutdown was the result of a UK-led dragnet in September 2017 that involved over a dozen law enforcement agencies in Europe, Australia and North America that went after hackers linked to the tool.

The investigation uncovered a network of crooks who distributed and used Luminosity worldwide and sold it to more than 8,600 buyers via the Luminosity.link website and the public internet forum HackForums.net (tucked under the Hacks, Exploits, and Various Discussions / Hacking Tools and Programs subforum). It sold for as little as $39.99 and was, as Europol described it, pretty much a turn-key malware kit, requiring little technical knowledge to be unleashed on thousands of victims.

As of February, investigators had already turned up stolen personal details, passwords, private photographs, video footage and data, and forensic analysis was still ongoing.

Though Grubbs initially claimed that Luminosity was a legitimate tool for sysadmins, he knew full well that many customers were using his software to remotely access and control computers without their victims’ knowledge or permission, according to the plea agreement… and, really, according to his tool’s marketing, which both claimed that it was a legitimate tool and also emphasized its malicious features.

Grubbs was indicted in June. The charges against him are conspiracy to defraud and obstruction of justice, which each carry penalties of up to five years in prison, a fine up to $250,000, and up to three years of supervised release. He’s also looking at a money-laundering count that could get him up to 20 years in prison, a fine of up to $500,000, and up to three years of supervised release. Maximum sentences are rarely handed out, though.

Sentencing is scheduled for 15 October.

Rat-B-GONE!

Here are some tips on avoiding having a RAT gnaw on your system:

1. Use a product such as Sophos Free Antivirus and Security to keep an eye out for malware, dodgy websites, adware and other potentially unwanted apps.
2. Keep all your software updated.
3. Install a good firewall.
4. Don’t open suspicious email attachments, even if you think a message is coming from somebody you know. Such links can be rigged with malware. Same goes for clicking on URLs, be they in email, text messages or on social media: any such could be infected.
5. Create strong passwords.

Here’s how to do that oh-so-important #5:

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/nER3_np3Ris/

Deep into an era dominated by mobile devices, it’s somewhat strange that users find themselves shackled to a password model invented for computers with full-size keyboards and screens.

Not surprisingly, entering password on a mobile device can be fiddly, not to mention the traditional problem of remembering lots of passwords or PINs and creating secure ones in the first place.

Pattern locks are a possible answer but come with disadvantages such as being easy to shoulder surf or detect using a smudge attack (detecting the grease prints left by fingers on a screen).

According to a new paper by researchers from Xi‘an Jiaotong-Liverpool University in China, we shouldn’t be surprised when research confirms that up to two thirds of mobile users cope with these inconveniences by abandoning passwords, PINs and even patterns to access their device, and simply hope for the best.

The team’s alternative – called SemanticLock – replaces passwords, PINs and patterns with a sequence of graphical icons which work semantically.

For example, the sentence “I eat breakfast with coffee” can be represented by four icons representing each word or concept in that sequence, which is easier to enter on a small screen than the equivalent alpha-numeric characters.

Theses icons can also be arranged quickly into the correct sequence from a palette of up to 20 icons in as few as two finger movements, the researchers claim.

So much for speed and memorability, what about security?

Conceptually, a sequence of icons should be as secure as a sequence of numbers, which is to say the security is the same as long as the palette of icons doesn’t lure people into using the same set of memorable sequences.

The position of the icons on the screen rotates over time which rules out smudge attacks.

In testing with 21 users, SemanticLock was slightly slower to use than patterns in some use cases but a bit faster than PINs. In terms of memorability, however, a chosen sequence was forgotten only 10% of the time as against 70% for patterns and 50% for PINs. Overall…

…comparing SemanticLock against other authentication systems, we discovered that SemanticLock outperformed the PIN and matched the pattern both on speed, memorability, user acceptance and usability.

On the basis of these results, one might assume that mobile device makers would be falling over themselves to implement SemanticLock, or something like it.

That assumption would be wide of the mark. Graphical and image-based authentication designs of various types are nothing new and yet today’s passwords still rely on alphanumeric characters, PINs and patterns.

The reason for this is that for all their drawbacks these designs got there first, a familiarity that makes shifting them extremely difficult.

Moreover, it’s likely that the sizable hardcore of users who don’t bother with today’s password, PIN and patterns would also ignore icons.

Meanwhile, smartphone makers have invested heavily in alternatives such as Apple’s Face ID. This isn’t perfect, but it’s at least as secure while being quicker and simpler than any system that asks users to enter data or perform an action to access their device. Perhaps then, passwords won’t be replaced by icons but by faces.

Follow @JohnEDunn
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/r-zY429v2mE/

Telefonica Spain has inadvertently exposed the personal details of customers of its Movistar division.

Names, addresses, fixed and mobile line numbers, email addresses and the call breakdown of Movistar customers were all exposed because of basic programming errors in Movistar’s online customer portal.

Anyone with a Movistar account could view other users’ personal data simply by changing the URL because of a basic enumeration bug¹. Modifying this online account ID referenced in the URL meant a users could then access other users’ account data.

FACUA, a Spanish non-profit that specialises in consumer rights protection, held a press conference and went public about the flaw on Monday.

The bug has been resolved at this point, hours after it was reported to Telefonica on Sunday, which is just as well because it was a real howler, as illustrated by the video below.

Youtube Video

Customers of Movistar’s landline, broadband, and television service were all at potential risk from the security breach, which came to light after a Movistar user reported it to FACUA.

It’s unclear whether or not the security slip-up has actually been exploited by miscreants to harvest users’ personal details. El Reg approached Telefonica/Movistar for comment via both email and Twitter but we’re yet to hear back. We’ll update this story as and when more information comes to hand.

FACUA has reportedly filed a complaint against Telefonica Spain and Telefonica Mobile with the Spanish Agency for Data Protection (AEPD). ®

Botnote

¹This type of flaw is technically known as a Insecure Direct Object Reference (IDOR), a basic problem on poorly designed web applications that has been known about for many years but still crops up more than occasionally.

Sponsored:
Minds Mastering Machines – Call for papers now open

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/07/18/telefonica_spain_privacy_snafu/