Taiwan-based computer hardware maker ASUSTeK Computer, Inc. has agreed to settle Federal Trade Commission charges that critical security flaws in its routers put the home networks of hundreds of thousands of consumers at risk. The administrative complaint also charges that the routers’ insecure “cloud” services led to the compromise of thousands of consumers’ connected storage devices, exposing…
Category: Of Note
Thinking about incident response
So I woke up to find that uKnowKids had issued a statement yesterday about their exposed database, an exposure that had been uncovered by and reported to them by Chris Vickery. Regular readers of this blog will recognize Chris’s name by now, as he’s uncovered a number of misconfigured databases that have been investigated by…
uKnowKids responds to reports of exposed database
uKnowKids has responded to reports that their database was exposed. As reported yesterday on this site, the details of 1,740 children being tracked by their software as well as other details were exposed in a misconfigured MongoDB installation. The exposed data included text messages and images from and to the children. The exposure was discovered by Chris…
You Can’t Hide Behind Your EULA
In response to VTech’s controversial new EULA in the wake of their massive data breach, Cooley LLP has a commentary. Here are some excerpts: Apart from being a bit mean, it goes against the basic principles of data protection and consumer law in the UK. The Data Protection Directive 95/46 EC places obligations on the…
uKnowKids database exposed personal and location info of 1,740 kids (Update1)
A misconfigured database from a child tracking & monitoring firm exposed over 6.8 million private child text messages, 1.8 million images (many depicting children), and over 1700 in-depth child profiles. uKnowKids monitoring software advertises that it “Makes Parenting Easier, and Keeps Kids Safe Online and on the Mobile Phone.” On its web site, it claims that it has helped parents protect…
NSA Wants ‘Zero Day’ Process Kept Secret
Nicholas Iovino reports: The National Security Agency on Thursday defended hiding key details of its process for deciding whether to exploit or disclose software security flaws that make people vulnerable to hackers. The Electronic Frontier Foundation sued the NSA in 2014 for withholding records on the government’s handling of “zero days,” newly discovered security flaws…