Search the Community

UPDATE: Other three data breach, Indihome (20th August GMT+7) and police data (Yesterday, GMT+7) Summary Another data breach coming from Indonesia, this time it's state owned electricity company (Perusahaan Listrik Negara). Reportedly PLN have over 17M consumer data breached, that includes SSN, consumer ID and address, power meter number, and even KW/h number. In other breachforum post, Indonesian branch of big companies also have 347GB of their data leaked, separated into standard (companies with revenue under $50M) and big (revenue >$50M). Examples include Microsoft Indonesia branch, AT&T Indonesia branch, China State Construction Engineering Corporation, China Railway Group Ltd, McKinsey Indonesia branch, Huawei Tech Investment and Prudential Life Assurance. Leaked data includes numerous ID, license and certificates, transaction records, and more. Quotes My thoughts I have zero hopes and expectations to be honest. If you saw the news about the entire PSE registration thingy you know cybersecurity in here is already that bad, that even state owned websites can be breached in just a few hours. No doubts it also going to even affects companies in Indonesia, and now here we are, again with data breach from not only state owned company but also Indonesian branch of big companies, and it even includes big tech names like Microsoft and AT&T. At this point not even Data Privacy law (that somehow even to this very second never gets passed) can save us I guess, it's just way too late Sources https://www.cnbcindonesia.com/tech/20220819121855-37-365025/data-pelanggan-pln-diduga-bocor-ini-kata-kominfo https://www.jagatreview.com/2022/08/data-perusahaan-indonesia-bocor-di-situs-gelap/ Nuice Media:

Looks like Intel has some more issues with CPU vulnerability. And my older hexcore i7 970 CPU is not on the list. I get to dodge this bullet due to running older tech! Bonus for getting a high performer that still handles most modern tasks, well or well enough. Classed as "microarchitecture data sampling" Found this article describing the issues. Includes links to various researcher's work https://www.theregister.co.uk/2020/01/28/intel_processor_data_leak/ Microcode updates expected in the future. Intel's release https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00329.html Affected processors include some from Skylake/Cascade Lake, Kaby/Coffee Lake, Whiskey Lake and Amber Lake. https://software.intel.com/security-software-guidance/insights/processors-affected-l1d-eviction-sampling

As just released a few hours ago on the Portuguese tech focussed web publication, Exame Informática, João Pina, an investigator in this field, has publicly announced on Twitter his findings when probing at the government's own websites. He has found out that the government authentication system (autenticacao.gov.pt) is sharing the personal information of whoever accesses the page with private company Facebook. Such findings have in the mean time been confirmed to the OP by another specialist that has prefered to stay anonymous. The website in cause has an embedded Facebook SDK into it. It has been so far confirmed that at least the user's IP address and browser version are being shared with the private company. This then allows Facebook to cross and match user identifiable data. Even if the user isn't logged in to Facebook, it can still keep track of the IP and browser version. João Pina also defends that the AMA (in english AAM or Agency for the Administrative Modernization), the institution responsible for the website in question, is also logging the user's email used to log in to Facebook, as found in the webpage's code. Presented with the facts, the AMA has forwarded any technical clarifications to the information available on the government's website. In a tab dedicated to social networks, it is stated that "no data is sent to social networks, according to the best practices". (comment: whatever that means...) Apart from this, it was also found that this platforms also have Google's data analysis platform, Analytics, embedded. As a Portuguese citizen myself I can only say that this is a complete and disgusting abuse on citizen privacy and that I really hope this doesn't go without severe punishment, not only for AMA but also for the government for not keeping tabs on who they should or being compliant and obviously for Mr. Zuck's childish 15 year old teenager. Source: Expert reveals that nation's authentication website is sharing data with Facebook - Perito revela que site de autenticação do Estado está a partilhar dados com o Facebook

Source: Facebook Before anything else, do you think this will make MySpace and Google+ great again? I don't know if I can take anything Facebook said at face value considering the ramifications of the entire controversy like allegedly influencing elections by leaking personal information and targeting those people with specific political ads. Unlike a typical bug bounty where a white hat/gray hat hacker does penetration testing to an OS or hardware, how is this going to happen with Facebook being mostly a web service? Is Facebook's source code even open source for inspection? Nonetheless, Mark Zuckerberg made a promise in the senate hearing that Facebook will not only follow the GDPR but extend those data protections to everyone and not just EU citizens as The Verge reports: But looking at The Verge article, even the lawmakers themselves aren't buying that Zuck will extent GDPR rules worldwide and I share the same sentiment. Facebook's business model is about ads and bid data and I doubt that so much will change despite the $40k bounty. Definitely this is Zuck's worst nightmare as CEO. Since Facebook is operating in the EU as well, he's probably glad that the controversy didn't erupt on May 25, 2018 which is the date where the GDPR will be enacted. I encourage everyone to listen to the following Marketplace Tech podcast with Molly Wood episodes in relation to the Facebook controversy: 04/11/2018: The Data Economy: the role of advertising 04/10/2018: The deal we made with our data 03/22/2018: What Congress wants to hear from Facebook