Security Friday

Link

Spotify Resets User Passwords Over Data Leak

Andrew Orr ·

Spotify has reset an unknown number of user passwords after a bug in its system exposed private data to business partners.

In a data breach notification filed with the California attorney general’s office, the music streaming giant said the data exposed “may have included email address, your preferred display name, password, gender, and date of birth only to certain business partners of Spotify.” The company did not name the business partners, but added that Spotify “did not make this information publicly accessible.”

Fortunately, those like me who created a Spotify account using Sign In with Apple shouldn’t have too much information leaked.

Link

Hackers Hide Credit Card Web Skimmer Inside Image Metadata

Andrew Orr ·

MalwareBytes reports that hackers are using a new trick to skim credit card data form websites using a skimmer hidden inside image metadata.

We found skimming code hidden within the metadata of an image file (a form of steganography) and surreptitiously loaded by compromised online stores. This scheme would not be complete without yet another interesting variation to exfiltrate stolen credit card data. Once again, criminals used the disguise of an image file to collect their loot.

A devious, clever hack.

Link

Michigan Prop 2 Passes; Police Need a Warrant to Search Your Devices

Andrew Orr ·

Voters in Michigan overwhelmingly passed Proposition 2 which adds “electronic data and electronic communications” to the state’s search and seizure laws.

The person, houses, papers, possessions, and electronic data and electronic communications of every person shall be secure from unreasonable searches and seizures. No warrant to search any place or to seize any person or things or to access electronic data or electronic communications shall issue without describing them, nor without probable cause, supported by oath or affirmation.

Translation: Michigan police need a warrant to search your electronic devices. And as a Michigander myself I definitely voted in favor of this.

Link

Mattel Revealed it Suffered a Data Breach on June 28

Andrew Orr ·

Toy company Mattel suffered ransomware attack on June 28, 2020. It revealed this in a 10-Q form filed with the Securities and Exchange Commission (SEC).

On July 28, 2020, Mattel discovered that it was the victim of a ransomware attack on its information technology systems that caused data on a number of systems to be encrypted. Promptly upon detection of the attack, Mattel began enacting its response protocols and taking a series of measures to stop the attack and restore impacted systems. Mattel contained the attack and, although some business functions were temporarily impacted, Mattel restored its operations.