Your Social Security Number May Be in This Data Broker’s Security Breach
Data broker Lexus Nexus has announced that the personal data of some 364,000 people may have been affected by a security incident with an unknown party. The data includes home addresses, social security numbers, and more. TechCrunch has the full story.
The Bottom Line: So far, there is no way to know if your data is exposed in this breach. That said, the digital hygiene steps outlined in our security course include using a privacy-preserving web browser, a VPN, and a data takedown service can help reduce your exposure to breaches like this. In the US, we badly need a general consumer privacy law to help police data brokers.
Phantom Database of Stolen Passwords Appears, Then Disappears
Like a ghost ship sighting, security researcher Jeremiah Fowler spotted an unsecured database on the internet containing 184 million records of passwords, as well as the email address or username and the account or service it would unlock. The credentials seemed to belong to accounts across Apple, Google, Microsoft, and lots of other services, and Fowler sent emails to a few of the addresses and got a few genuine responses, proving they were active. However, before he could research further, the database vanished. Wired has the full story.
The Bottom Line: Always use multi-factor authentication for your online accounts. As with the story above, there is no way to know if your passwords or accounts were in this database. However, if you use multi-factor authentication, then your accounts should be safe. Databases like this, which contain usernames and passwords, are fairly common on the black market, but the combination of a username and password will not get access to your account if it is secured by strong multi-factor authentication, such as a passkey or hardware key.
Scammers Use GenAI to Lure Victims into Downloading Malware, Warns Google
We reported two weeks ago about the danger of fake GenAI services that offer to turn a photo into a video, but instead of a video, they send you malware. Now Google’s Threat Intelligence blog has written up the scam.
The Bottom Line: Continue to be cautious about files you download from the internet. Always check the file type to make sure the file is of the type you intended to download. For example, if you intend to download a video, then file types that end with .mov or .avi would be expected. Be especially wary of files with multiple file type extensions. It’s always a good idea to do a little research into a new website or service to make sure it’s legitimate.
Block Annoying Ads with CleanWeb
CleanWeb keeps your device free from annoying ads and protects you from harmful malware, making browsing safer, faster, and more enjoyable. CleanWeb is part of Surfshark, one of our favorite VPN providers. It only takes a few minutes to get set up, and you’ll start seeing the benefits right away. Get it right now for as low as $2.19 per month (86% off) plus an extra 3 months free!
Can GenAI Personas Fool the Government?
According to a Wall Street Journal investigation, someone seems to be trying to use a GenAI persona to impersonate the White House Chief of Staff, Susie Wiles, in text messages and other communications sent to a swath of leaders in the US, including senators, governors, and business bigwigs.
The Bottom Line: GenAI systems can analyze sample recordings of someone’s voice and generate new audio sounding just like them, saying anything the creator likes. Since audio samples of important public figures are widely available online, an audio voicemail would be extremely easy to fake. To combat this, consider establishing lines of expected communication and distrusting messages that come from outside those lines. Always insist on in-person or video meetings to verify identities. Use Apple’s contact key verification where possible, or the equivalent feature on Signal.
EU Developing Digital Age Verification Tool
Last week, we reported that Texas would soon be passing a bill that would require the App Store and Google Play Store to verify the ages of users before allowing them to download apps. Well, now the European Union has announced it is working on a tool that will allow users to verify their ages through the government rather than through Apple or Google. The privacy-focused solution is designed to work with the EU Digital Identity Wallet so that users can easily access age-restricted sites and apps without having to turn their ID over to third parties.
The Bottom Line: A government-issued app seems like the ideal solution to the age verification dilemma that’s becoming a bigger issue every day. Although that depends entirely on how much one trusts their government to develop a secure and private app in the first place.
Mozilla Firefox Extension Store Will Scan for Crypto-Stealing Extensions
Web browsers, including Chrome and Firefox, offer expanded features through their extension stores. Browser extensions are tiny programs that add on to the features of your web browser with things like an ad-blocker or a new color palette for your browsing tabs. We have long warned about the dangers of web browser extensions because any browsing extension capable of doing anything worthwhile will likely need to be able to see everything you do on the internet in order to function. But another danger of browser extensions is cryptocurrency theft. Many cryptocurrencies are stored in browser extensions. So, thieves have developed innocuous-looking browser extensions that, when installed, will scan to see what other extensions are already installed; and if any hold crypto, they steal it. Mozilla is now adding a capability to its browser extension store to scan new extensions for this malicious capability.
The Bottom Line: In general, we still recommend avoiding browser extensions except for your password manager and ad blocker. If you must store some cryptocurrency, we recommend using a dedicated hardware wallet.
US Sanctions Network Cloud Services Used by Pig Butchering Scammers
The scamming industry has few darker topics than pig butchering, which accounts for billions of dollars in theft each year. The scammers develop relationships of trust with their intended victims over weeks or years, and then eventually invite the victim to invest in a cryptocurrency. They allow the victim to withdraw funds from their fraudulent investment account at first, to prove that it is real, and then pressure the victim to invest more heavily, including by taking out loans. Once the victim has no credit left to invest, the scammer empties the account and disappears. Victims often lose everything — retirement, college fund, mortgage, credit score — everything. To make matters even worse, the scam’s perpetrators are often working under duress: victims of human trafficking forced into prison compounds in Southeast Asia where they must work cryptocurrency scams under threat of torture or death. These scams account for billions of dollars in revenue for those regions, and with so much money involved, local governments have proven unwilling to crack down. However, with so much money involved, that also affords an opportunity to apply pressure to the services and infrastructures needed to move and manage all that money. The US is sanctioning a cloud services provider called Funnull that has been caught providing the complex infrastructure necessary to evade safety systems and show scam websites to victims.
The Bottom Line: Destroying such a powerful conglomerate of criminal enterprises, with such extraordinary funding at its disposal, will require a coordinated international effort across many different angles of attack. This sanction alone is unlikely to reduce your risk of pig butchering, but it is one offensive in the war. Continue to protect yourself and your friends and contacts by insisting on video calls to verify the identities of your online contacts (even though live video can now be spoofed with AI, it’s still your best bet) and by treating cryptocurrency investment opportunities with skepticism.
NordVPN 2-in-1 Deal: Save 76% & Get Free eSIM Data
You wouldn’t leave your front door unlocked, right? Your online data is just as crucial and just as vulnerable as your physical possessions. NordVPN is here to help keep your browsing private and your data safe. Sign up today and get 76% off plus up to 10GB free eSIM data from Saily.
