Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Websites. Show all posts
Websites
address Privacy VPN Websites

Remove Your Home Address From the Internet - Here's How

 




This is not only an issue of personal privacy but also safety. Many organisations sell address data to brokers, who then distribute their contents to advertisers, identity thieves, or even burglars. Here's the step-by-step process of how to delete your home address off the web.


Share Your Address Only When Necessary 


Keep your address private by limiting how often you give out your home address. Share it only when you must, like when opening a bank account or registering to vote. You can use an alternate address elsewhere, for example, when signing up for a gym membership or getting deliveries. That little change makes a big difference to the privacy of your home address online.


Mask Your Address in Mapping Apps


Online maps usually have very clear street views of your home. Thankfully, apps such as Google Maps and Apple Maps can blur your home for privacy. For Google Maps, enter your address, go to Report a Problem, then the areas you'd like to blur. For Apple Maps, write to their team at mapsimagecollection@apple.com, with details of your home, and they will handle it.

Remove Your Address from Search Results


You have the right to request its removal, if it appears on a search engine. Google offers users the ability to track and control personal information online. One can visit their Google Account and navigate to the Results About You section to set alerts and even request removal of the address from certain search results. Remember that Google could retain content from government or business sites.


Know your Social Media Profiles


Review your social media profiles for those instances where you published your house address. Never post a photo with your street or house number. Periodically update your privacy setting to restrict access to your information.


Opt Out from Whitepages


Whitepages is the biggest collection of addresses online. To remove yourself from it, visit their Suppression Request page, search for your profile, and make a suppression request for removal of it. You can easily do this in a few minutes.


Cleaning Up Unused Accounts


Most websites and services save your address whenever you sign up. Accounts you don't use anymore—like old shopping sites or subscription services—and delete them or request that your data be erased. That's fewer chances of a leak or misuse. You could also use a Post Office Box as an alternative.

The use of a post office box can make certain that one private home address does not have to be revealed. You can apply through USPS to lease a box for as low as $15 monthly online. This address could be used for deliveries or other accounts; it conceals your place of residency.

 

Use a Virtual Mailbox


Added to that is the security factor - virtual mailboxes have a secure option. They scan and forward your mail and allow you to access it online. It's thus comfortable for a frequent traveller, thus anyone who wants to avoid physical mail at his doorstep.


Securing Your Address with a VPN


Finally, make use of a virtual private network (VPN) to encrypt your internet data. Also, keep the physical location private. It conceals where you are physically based as you go online. Many browsers also have this built-in VPN option for additional security as well.

Removing your home address from the internet may take some effort, but the peace of mind it brings is worth it. By following these steps, you can protect your privacy and stay safer in an increasingly connected world. 


Read more »
Websites
Customer Manipulation Cyber Security Cyberattacks CyberCrime Cyberthreats Dark Patterns ICPEN Websites

Subscription Services Accused of Using 'Dark Patterns' to Manipulate Customers

 


It is a widespread practice among subscription sites to manipulate customers' behaviour around subscriptions and personal data to influence their decisions, according to a new report by two international consumer protection organizations. It is defined as the practice of guiding, deceiving, coercing, or manipulating consumers in ways that often aren't in their best interests when using an online user interface. 

An international research effort was conducted by the International Consumer Protection and Enforcement Network, along with the Global Privacy Enforcement Network, both of whom are responsible for conducting consumer protection and enforcement investigations. As a result of a review of selected websites and apps, the Federal Trade Commission and two international consumer protection networks reported that a significant portion of the websites and applications examined may be manipulative of consumers into buying products or services or revealing personal information to third parties. 

These dark patterns, and digital design techniques, can be found in most of the websites and apps examined that use these techniques. These types of strategies may be able to persuade consumers to take actions that they would not generally take. In an internet survey carried out by the Internet Society, an analysis was carried out of the websites and mobile apps of 642 traders. The study found that 75,7% of them had at least one dark pattern on their websites, and 66,8% had at least two or more dark patterns on their websites. 

An online user interface's shadow patterns are defined as the subtle, deceptive, coercive, or manipulative strategies used to steer, deceive, coerce, or manipulate users into making decisions that are not necessarily in their best interest and are rather detrimental to them. As part of the annual International Consumer Protection and Enforcement Network (ICPEN) sweep, which took place from January 29 to February 2, 2024, the 2018 Sweep was hosted by ICPEN. 

To conduct the study, participants were asked to serve as sweepers, representing 27 consumer protection enforcement authorities from 26 different countries. There has been a coordinated sweep between the ICPEN and the Global Privacy Enforcement Network (GPEN) for the very first time. In a world that is becoming increasingly global in terms of standards, regulations, and technology, GPEN is a membership-based network of over 80 privacy enforcement authorities, whose mission is to foster cross-border cooperation among privacy regulators and effectively protect personal privacy. 

Consumer protection is increasingly becoming intertwined with other spheres of the regulatory system due to the growing intersections. The assessment of the deceptive design patterns by both privacy and consumer protection sweepers who were conducting a review of website and app content demonstrated that many of these sites and apps employ techniques that interfere with the ability of individuals to make educated decisions to protect their rights as consumers and privacy. 

As a result of the analysis, the scourges rated the sites and apps from a point of view of six indicators that are characteristic of dark business practices according to the Organisation for Economic Co-operation and Development (OECD). A study conducted by ICPEN found that there were several potential sneaky practices, for example, the inability to turn off auto-renewal of subscription services by consumers, or interference with the user interface. These practices, such as highlighting a subscription that is beneficial to the trader, were particularly frequent during the survey period. 

In a recent publication, ICPEN and GPEN, a pair of organizations that are helping improve consumer protection and privacy for individuals throughout the world, have both released reports that outline their findings. On the ICPEN's website, users will find the report, and on the GPEN's website, they will find the report. GPEN has released a companion report exploring black patterns that could encourage users to compromise their privacy as a result of them. The majority of the more than 1,00 websites and apps analyzed in this study used a deceptive design practice in the development of their websites. 

As many as 89 per cent of these organizations had privacy policies that contained complex and confusing language. In addition to interface interference, 57 per cent of the platforms made the option with the least amount of privacy protection the easiest one to pick, and 42 per cent used words that could influence users' opinions and emotions in the privacy choices. The subtle cues that influence even the most astute individuals can lead to suboptimal decisions. 

These decisions might be relatively harmless, such as forgetting to cancel an auto-renewing service, or they might pose significant risks by encouraging the disclosure of more personal information than necessary. The recent reports have not specified whether these dark patterns were employed illicitly or illegally, only confirming their presence. This dual release underscores the critical importance of digital literacy as an essential skill in the modern age. Today's announcement coincides with the Federal Trade Commission (FTC) officially assuming the 2024-2025 presidency of the International Consumer Protection and Enforcement Network (ICPEN).

ICPEN is a global network of consumer protection authorities from over 70 countries, dedicated to safeguarding consumers worldwide by sharing information and fostering global enforcement cooperation. The FTC has long been committed to identifying and combating businesses that utilize deceptive and unlawful dark patterns. In 2022, the FTC published a comprehensive staff report titled "Bringing Dark Patterns to Light," which detailed an extensive array of these deceptive practices. 

The Federal Trade Commission collaborates with counterpart agencies to promote robust antitrust, consumer protection, and data privacy enforcement and policy. The FTC emphasizes that it will never demand money, issue threats, instruct individuals to transfer funds, or promise prizes. For the latest news and resources, individuals are encouraged to follow the FTC on social media, subscribe to press releases, and subscribe to the FTC International Monthly.
Read more »
Websites
Black hat malware Online Security URL Websites

Cybercriminals Exploit Web Hosting Platforms to Spread Malware


 

Cybersecurity researchers at Zscaler ThreatLabz have uncovered a concerning trend in which cybercriminals are exploiting popular web hosting and blogging platforms to disseminate malware and steal sensitive data. This sophisticated tactic, known as SEO poisoning within the realm of Black Hat SEO techniques, has been employed to manipulate search engine results, pushing fraudulent websites to the forefront of users' search queries, thereby increasing the risk of unwittingly accessing malicious content.


How They Operate

The cybercriminals orchestrating these operations have devised intricate strategies to evade detection and entice unsuspecting users into downloading malware. They fabricate fraudulent websites spanning a wide array of topics, ranging from pirated software to culinary recipes, often hosted on well-established platforms such as Weebly. By adopting the guise of legitimate sites, complete with endorsements like "Powered by Weebly," they exploit users' trust in reputable services to perpetrate their malicious activities.


The process commences with cybercriminals setting up sham sites on web hosting services, adeptly avoiding detection by both hosting providers and users. When individuals search for relevant content and click on links from search results, they unknowingly find themselves on these malevolent sites. To circumvent scrutiny from security researchers, the perpetrators implement evasion techniques, including scrutinising referral URLs. Should a user access the site directly, indicating a potential analysis, the site tactfully sidesteps redirection to preserve its cloak of invisibility.


The Payload Delivery System

Malicious payloads are secretly delivered through multi-layered zipped files concealed within seemingly innocuous content. For instance, an individual seeking cracked software may inadvertently download malware instead of the anticipated content. Upon execution, the malware puts together a sequence of activities, encompassing process hollowing and DLL sideloading, aimed at downloading additional malware and establishing communication with command-and-control servers.


Tricks to Avoid Detection

To further complicate their activities, threat actors employ techniques, including string concatenation, mathematical manipulation, and the utilisation of password-protected ZIP archives. These tactics serve to confound security measures, rendering the malicious code arduous to decipher and bolstering the malware's ability to slightly pass over detection.


Data Theft and Deceptive Tactics

Once ensconced within a system, the malware embarks on an mission to harvest extensive troves of data, encompassing system information, browser data, credentials, and browsing history. Additionally, it sets its sights on emails pertaining to cryptocurrency exchanges, adeptly modifying email content and intercepting one-time authentication codes to facilitate unauthorised access.


How To Protect Yourself?

Keeping in mind such campaigns, users are advised to exercise utmost caution when procuring software from unfamiliar sources and to prioritise visiting reputable websites. Staying abreast of emerging cybersecurity threats and securing defences with robust protocols can substantially mitigate the risk of succumbing to potential infections.



Read more »
X
malware Netflix phishing URLs Websites X

X's URL Blunder Sparks Security Concerns

 



X, the social media platform formerly known as Twitter, recently grappled with a significant security flaw within its iOS app. The issue involved an automatic alteration of Twitter.com links to X.com links within Xeets, causing widespread concern among users. While the intention behind this change was to maintain brand consistency, the execution resulted in potential security vulnerabilities.

The flaw originated from a feature that indiscriminately replaced any instance of "Twitter" in a URL with "X," regardless of its context. This meant that legitimate URLs containing the word "Twitter" were also affected, leading to situations where users unknowingly promoted malicious websites. For example, a seemingly harmless link like netflitwitter[.]com would be displayed as Netflix.com but actually redirect users to a potentially harmful site.

The implications of this flaw were significant, as it could have facilitated phishing campaigns or distributed malware under the guise of reputable brands such as Netflix or Roblox. Despite the severity of the issue, X chose not to address it publicly, likely in an attempt to mitigate negative attention.

The glitch persisted for at least nine hours, possibly longer, before it was eventually rectified. Subsequent tests confirmed that URLs are now displaying correctly, indicating that the issue has been resolved. However, it's important to note that the auto-change policy does not apply when the domain is written in all caps.

This incident underscores the importance of thorough testing and quality assurance in software development, particularly for platforms with large user bases. It serves as a reminder for users to exercise caution when clicking on links, even if they appear to be from trusted sources.

To better understand how platforms like X operate and maintain user trust, it's essential to consider the broader context of content personalization. Profiles on X are utilised to tailor content presentation, potentially reordering material to better match individual interests. This customization considers users' activity across various platforms, reflecting their interests and characteristics. While content personalization enhances user experience, incidents like the recent security flaw highlight the importance of balancing personalization with user privacy and security concerns.


Read more »
Websites
Attack Blackcat hackers Change Healthcare critical infrastructure providers Data Breach digital decryption keys Extortion Hospitals International law enforcement seizure Websites

Notorious Hacker Group Strikes US Pharmacies

In December, international law enforcement targeted a gang, leading to the seizure of various websites and digital decryption keys, as reported by Reuters. In response to this crackdown, the Blackcat hackers threatened to extort critical infrastructure providers and hospitals.

A recent attack on Change Healthcare, resulting in its parent company UnitedHealth Group disconnecting its systems to prevent further impact, has caused disruptions in prescription insurance claims, according to the American Pharmacists Association. This outage, which has persisted through Tuesday, is attributed to a notorious hacker group, as per a new report.

The outage at Change Healthcare, which handles payment management for UnitedHealth Group, was caused by a ransomware attack by hackers associated with Blackcat, also known as ALPHV, according to Reuters, citing anonymous sources. Blackcat has been involved in several recent high-profile data breaches, including attacks on Reddit, Caesars Entertainment, and MGM Resorts.

As a result of the breach, pharmacies nationwide are facing significant delays in processing customer prescriptions. Change Healthcare stated they are actively working to restore the affected environment and ensure system security.

UnitedHealth Group mentioned that most pharmacies have implemented workarounds to mitigate the impact of the outage on claim processing. The company expressed confidence that other data systems in its healthcare portfolio were unaffected by the breach.

While last week's breach was suspected to be "nation-state-associated," according to an SEC filing by UnitedHealth, it's uncertain if the group responsible was sponsored by foreign actors. Cybersecurity firms Mandiant and Palo Alto Networks, appointed by UnitedHealth, will lead the investigation into the breach.
Read more »
Websites
Cyberattacks CyberCrime Cybersecurity IBM JavaScript malware Software Web Injections Websites

Sophisticated Web Injection Campaign Targets 50,000 Individuals, Pilfering Banking Data


Web injections, a favoured technique employed by various banking Trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cybercriminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. 

In a new finding, it has been revealed that the malware campaign that first came to light in March 2023 has used JavScript web injections in an attempt to steal data from over 50 banks, belonging to around 50,000 used in North America, South America, Europe, and Japan.  

IBM Security has dissected some JavaScript code that was injected into people's online banking pages to steal their login credentials, saying 50,000 user sessions with more than 40 banks worldwide were compromised by the malicious software in 2023. As IBM’s researchers explained, it all starts with a malware infection on the victim’s endpoint. 

After that, when the victim visits a malicious site, the malware will inject a new script tag which is then loaded into the browser and modifies the website’s content. That allows the attackers to grab passwords and intercept multi-factor authentication codes and one-time passwords.

IBM says this extra step is unusual, as most malware performs web injections directly on the web page. This new approach makes the attacks more stealthy, as static analysis checks are unlikely to flag the simpler loader script as malicious while still permitting dynamic content delivery, allowing attackers to switch to new second-stage payloads if needed. 

It's also worth noting that the malicious script resembles legitimate JavaScript content delivery networks (CDN), using domains like cdnjs[.]com and unpkg[.]com, to evade detection. Furthermore, the script performs checks for specific security products before execution. Judging by the evidence to hand, it appears the Windows malware DanaBot, or something related or connected to it, infects victims' PCs – typically from spam emails and other means – and then waits for the user to visit their bank website. 

At that point, the malware kicks in and injects JavaScript into the login page. This injected code executes on the page in the browser and intercepts the victim's credentials as they are entered, which can be passed to fraudsters to exploit to drain accounts. The script is fairly smart: it communicates with a remote command-and-control (C2) server, and removes itself from the DOM tree – deletes itself from the login page, basically – once it's done its thing, which makes it tricky to detect and analyze. 

The malware can perform a series of nefarious actions, and these are based on a "mlink" flag the C2 sends. In total, there are nine different actions that the malware can perform depending on the "mlink" value. These include injecting a prompt for the user's phone number or two-factor authentication token, which the miscreants can use with the intercepted username and password to access the victim's bank account and steal their cash. 

The script can also inject an error message on the login page that says the banking services are unavailable for 12 hours. "This tactic aims to discourage the victim from attempting to access their account, providing the threat actor with an opportunity to perform uninterrupted actions," Langus said. Other actions include injecting a page loading overlay as well as scrubbing any injected content from the page.  

"This sophisticated threat showcases advanced capabilities, particularly in executing man-in-the-browser attacks with its dynamic communication, web injection methods and the ability to adapt based on server instructions and current page state," Langus warned. "The malware represents a significant danger to the security of financial institutions and their customers." Cybercriminals are exploiting sophisticated web injection techniques to compromise over 50,000 banks throughout the world as a threat escalating. 

DanaBot or similar malware entails the manipulation of user data through JavaScript injections, which allows them to steal login credentials with ease. In this dynamic attack detected by IBM Security, malicious scripts are injected directly into banking pages, evading conventional detection methods, and resulting in a dynamic attack. 

As a way to prevent malware infections, users are recommended to keep their software up-to-date, enable multi-factor authentication, and exercise caution when opening emails to prevent malware infections. To ensure that we are protected from the evolving and adaptive nature of advanced cyber threats, we must maintain enhanced vigilance in identifying and reporting suspicious activities.
Read more »
Wi-Fie
Android Cyber Attacks Cybersecurity Google Account iOS Location Sharing Websites Wi-Fie

Avoid Accidentally Sharing Your Location

 


There is no doubt that the devices and apps on your phone want to know where you are-whether to give you the latest weather updates, make suggestions for restaurants that you might enjoy, or allow you to better target advertisements. To keep track of what you share with others and what you do not share with others, and when, it can become very confusing very quickly.  

There is also a possibility that there are inconsistencies in the different location histories logged by your devices: There are some times when you think that you have blocked or turned off Location Sharing on your phone but that you are still tracked, and vice versa. 

Location Tracking: How it Becomes Confusing 

There is nothing more frustrating than being able to keep finding yourself on a map, even though you distinctly recall turning your location tracking off on a device. You might also have thought that you had left the location history feature on, but you are seeing gaps even though you thought you had? In terms of a few explanations, it is essential to keep in mind all the different ways in which your location can be logged by different devices, apps, and websites that you use during the day: your apps, your devices, and your websites. 

A tablet, for instance, might be equipped with a location-tracking feature whereas a phone might have its location-tracking turned off. Another possibility is that your laptop is tracking your location in the background. This is even though you thought you had disabled such a feature in the apps you use. You thought you had disabled it on your laptop. To determine whether or not to enable or turn off location tracking completely, you have to consider all of these different methods of keeping track of your location as well. 

Here is an example of how to use your Google account if you have one. On the web, simply go to your account settings, where you will be able to select Data and Privacy, along with Location History. This will reveal some desktop computers, laptops, and tablets whose movement is being saved to your Google account for future reference. Select Devices on This Account to see which phones, tablets, and laptops have been marked with a checkmark. 

When you click Turn Off, you will be able to disable this feature, but you should be aware of the caveats that appear onscreen once you have clicked the 'Turn Off' button: Your location will still be logged by your mobile device, by the Find My Device service when you are trying to locate a lost device, and by Google Maps when you are trying to navigate or search around the area in which you are. There is a facility in the Location History settings menu that allows you to toggle between different aspects of your location history. This includes the Google Timeline and the ability to search for places you regularly visit in a matter of seconds. 

It is worth noting that there are several other areas where your location is logged and shared from your main Google account screen. A list of specific contacts who can see your location through Google services can be found under Data and Privacy under Web & App Activity, and under People and Sharing under Manage Location Sharing. This allows you to manage location data saved by Google Maps and other applications and websites. 

Mobile Location Tracking and Management 

Depending on the manufacturer of your Android phone, the steps involved in managing your location will differ slightly. However, the menus and instructions involved will generally be similar regardless of the manufacturer of your phone. In Google Pixel phones, you can open up your Settings app, then select Location: Then you will see a switch that allows you to turn off the use of location, which will prevent any of the apps on your device from knowing your location, as well as Google. 

It is also possible to customize location access for individual apps on the same screen if you leave the Use Location toggle switch turned on. If you want to control when apps have access to your location, you can choose to set it to always or only when the app is running in the foreground. The app in the list you choose can be changed by tapping on its name. 

To eliminate the location data that has been collected on you, you need to check the history of all the apps that have had access to your location and check the settings of each and every one of them. You can either choose to delete Location History from your Google account on the web or Web & App Activity under Data and Privacy. This is if you want to completely remove such data from your Google account and Google's apps. Moreover, you will also have the option to automatically delete this information after a period of three, eighteen, or thirty-six months. 

Apple does not seem to log your movements in quite the same way as Google does, but it does build up a list of places you visit frequently (like your home and maybe your workplace) so you can quickly get back there if necessary. Open the Settings app on your iPhone, and then select Privacy & Security, Location Services, System Services, and Significant Locations to remove any items from this list. If you want to stop the list from populating in the future, you can opt to remove this entry from the list. 

On-Desktop Location Tracking 

Since your laptop or desktop computer will not be equipped with GPS capabilities, it will not be able to track your location the way your smartphone can, but you can still log into the internet on your computer through the network connections you use to sign in (via your home Wi-Fi, for example). However, the apps, websites, and operating systems will still have a sense of where you are.

Whenever you open up the Settings app on your Windows computer, you can click on Privacy & Security and then choose Location. As with Android and iOS, you will find that you can turn off location tracking for individual applications (via a toggle switch located on the right of the screen) or turn it off for the entire computer (by selecting the top option). By clicking on Clear next to Location History, you will be able to wipe the log of your travels. In this case, you may view which apps have been using your location, as well as see what apps are currently using your location. 

There will be settings within every browser that will allow you to control the way your location is accessed by websites. Chrome has a setting called Privacy and Security, Site Settings, and Location which can all be accessed from the settings pane; Edge requires opening the settings pane and choosing Cookies and Site Permissions, then Location; on Safari on MacOS, the setting dialog box must be opened before selecting Websites and Location. No guarantee changing these settings will affect any information that the sites have collected in the past. You will have to find out if this is the case by visiting the settings for individual websites.   
Read more »
Websites
Cyber Frauds Holiday Shopping Online Shopping Websites

Warning for Shoppers: Be Aware of Ransomware

 


With time, cyber attackers are getting updated and using more advanced technologies to steal data and blackmail the victims to get the ransom. One such case happened last year with Austin business Tiny Pies’ Instagram.

The co-founder of Tiny Pies in Austin, Amanda Wadsworth, commented on this incident and explained that they received a mail from an unknown source, and though it looked unauthorized, they clicked on it. After opening the mail, the cyber attackers hacked their system and locked their data. They coerced them to give ransom or else they will delete the account. 

Many cases showed that attackers threaten the victims for a ransom, or else they will leak confidential information on the dark web, where a large amount of such important information is already uploaded, as a consequence of cyber-attacks. 

Bobby Stempfley, the vice president and business unit security officer for Dell Technologies, commented on the rise in cyber-attacks. Dell also has to face many cyber-attacks on Dell. 

She stated that the organizations hold an “astronomical amount of data.” The organizations are managing data that is ten times more than the data that was there five years ago. 

She mentioned, “It is an environment where, when you put in better protections, the threat actors work to find better ways to go, work around those protections.” 

Considering the passion of cyber attackers to continuously find new ways to invade into target’s system and steal data, Stempfley started training employees of Dell to educate them about this ransomware and make them able to identify phishing and other attacks by ransomware. 

Alert for holiday shoppers 

The security company Tanium said that the cases of cyber-attacks are maximum during the holiday shopping season. Tanium added that hackers target when there is higher traffic on websites, such as on holidays, when people surf online more to find good deals. 

Melissa Bischoping, the endpoint security research director at Tanium, said that "security is not just the responsibility of the company storing your data, but it is also an equal responsibility of the shoppers to be alert and aware of such attacks." 

She explained, Shoppers should be cautious when they receive an email and first confirm whether it is legitimate or not. Prefer the trusted official app or the website instead of clicking on the links in emails with “a holiday sale” text. 

She talked about other holiday scams that are carried out using botnets. Cyber attackers collect items that are popularly in demand and add them to sell. Melissa said that the updated technology is working as a helping tool for cyber attackers to target the victims. 

To use the technology as a productive tool for your purpose instead of making it a weapon for hackers, you should follow some tips while shopping for sales online, such as: 

1. In case you receive an email for a shopping sale, do not click on it directly. Search for its authentication on websites or apps. 

2. Do not leave your credit card unchecked. Keep checking your credit card to know if there are any fraudulent charges. 

3. Create different passwords for different websites and apps where you shop from.
Read more »
Subscribe to: Posts (Atom)