Equifax Has Sold Private Data Including Salary Details of Millions of Employees To Other Companies

Equifax-owned company called Workforce Solutions, also known as The Work Number (TALX), sold salary data of its employees to debt specialists, financial service companies, and other organizations. Facebook Inc. is one of those companies buying such data despite the fact that the U.S. Federal Trade Commission put Facebook on privacy probation.

It is well known that social media such as Facebook now encourage their users to share their private data online. These sites’ entire policies are based on encouraging their customers to share their private lives as much as possible. The data shared (most of the time voluntary) is sent to several organizations and companies regardless of users’ consent. Despite the fact that social media users share their private lives online, salary is one of the sacred areas to most people, people who would not want to post publicly how much they earn. Facebook has been buying data from Equifax and also selling all the private data it collects from its users back to several companies including Equifax which had a breach to expose 143 million Americans’ private information.

Equifax Work Number database now contains over 296 million employment records and contains employees at all wage levels, from CEOs to interns. Considering how loose their security level is, apparent from breaches, it is not even a surprise there was unauthorized access to their employee tax records, lasting over a year, from April 2016 to May 2017. Cybersecurity expert Brian Krebs states that ‘crooks were able to reset the 4-digit PIN given to customer employees as a password and then steal W-2 tax data after successfully answering personal questions about those employees,’ to breach TALX’s databases, the Tax Form Management platform. He said due to this method of breaching, Equifax has no idea how many employees were affected from it. Krebs also reported that last September, a research team was able to access 14,000 consumer records after slipping into an online portal where Equifax employees in Argentina manage credit report disputes from consumers, as the password combination was set to an easy guess such as admin/admin.

Equifax-owned The Work Number has such a detailed database about salary data they put on sale that it shows week-by-week data for years, health care providers, types of health care coverage, files of unemployment claims and more. The data The Work Number owns and sells includes 12 million records.

Equifax can easily get and store such private and hidden information through thousands of U.S. businesses, including Fortune 500 companies, government agencies (who hold 85 percent of the entire country’s population), the Department of Defense and even schools. These sectors and people let Equifax tap directly into their data so that the credit bureau can have the latest job information and they even pay for Equifax to own their workers’ private information as they see it as a privilege. Once Equifax collects the private data, it sells the data to third parties such as debt agents, social media giants like Facebook Inc., and various companies giving financial services.

A good example could be given when we look at Facebook employees. A typical employee at Facebook may require verification of his employment through TALX when he applies for a loan, public aid, or a new job. If his new prospective employer is among the 70,000 approved entities in Equifax’s verifier network with a “permissible purpose”, that company can purchase his employment and income information for about $20. Prospective landlords can verify an applicant’s income through The Work Number, or human resources departments can examine an applicant’s background information much cheaper.

How the Work Number process works, according to a 2007 slide about Equifax’s $1.4 billion acquisition of TALX that year. Image: SEC

Of course, gathering data which was more than a fifth of the firm’s $3.1 billion revenue last year makes TALX one of the most profitable businesses of Equifax. Rick Smith, Equifax’s former CEO, said at an event at the University of Georgia in August. “That acquisition, by the way—I don’t know if I’m proud of this or not—but it’s worth about $9 billion today.”

Equifax already confirmed in an emailed statement to News as it shares ‘job data’ with debt collectors and others in agreement with Fair Credit Reporting Act guidelines.

Despite the fact that the Work Number database presents a continuous threat for both employees and consumers with their large database to private data and with little to no protection to it, the Work Number stated they will continue to supply such data for their customers, the sale of the data is included.

Such private data being shared by financial companies means your health status, credit history, financial status, debts, salary, your bank accounts and several other private details about your life are exposed to many organisations and companies. When, for instance, you fail to pay for your credit card debt or hospital bill, the companies can withdraw this amount from your bank account and you won’t even realize it unless you see a detailed account report.

At this point, there does not seem to be a real solution to this big scandal concerning the violation of private data since the Federal Trade Commission (FTC), which is supposed to take care of such issues, also sends its employees’ data to Equifax and it is an Equifax client as well. FTC regularly sends wage and work information about its attorneys and staff members to the Work Number database.

Trade specialists comment about one of the biggest scams of our century concerning the violation of company’s customer related data as a ‘secret CIA’ since it is being done legally and nobody does anything about to prevent it.

Sources:

https://www.fastcompany.com/40485634/equifax-salary-data-and-the-work-number-database

https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/

https://www.nbcnews.com/technology/exclusive-your-employer-may-share-your-salary-equifax-might-sell-1B8173066

Sharing is caring...
Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInPin on PinterestShare on RedditShare on StumbleUponDigg thisShare on TumblrShare on VKFlattr the authorShare on YummlyBuffer this pageEmail this to someonePrint this page

Facebook creates scary “shadow profiles” with information you never wanted to give

Everyone already knows Facebook is obsessed with collecting your private information. Data collection seems to be the primary business goal of this company these days. However, what most people do not know is that Facebook does not just collect and archive data taken from your profile. No, Facebook actually keeps huge databases of so called “shadow profiles”. These profiles contain information you never gave to them, infact we are pretty sure you would never allow them to have it.

For example, Facebook is a major customer of third-party data-brokers, who compile huge dossiers on people based on their spending, internet and phone usage, employment history and so on. In addition, Facebook encourages users to upload their entire address books to their system to “find your friends,” and while doing this, most Facebook users do not realize that they are leaking sensitive information, including nicknames, private numbers, and connections to the system.

Facebook mines this data to create their “shadow profiles” of its billions of users. And yes, these profiles are literally filled with data about you that you have never consciously provided to the system. It is data mined from third parties, including your friends, but also those spooky data-brokers we mentioned before. Facebook’s shadow profile system was first confirmed in 2013 when it accidentally leaked all of the users’ shadow profiles to them along with their own data. Something the company says it will never do again out of (ironic) respect for the privacy of the people who provided the data that goes into your shadow profile.

The “shadow profiles” are involuntary and there’s no opt-out. Facebook even has shadow profiles on people who don’t use the service. For example, even though I’m not a Facebook user anymore, multiple people have uploaded their address books containing my email and phone number to the system, thus allowing Facebook to create a profile of my contacts by looking at who lists me as a contact.

Ofcourse Facebook doesn’t like, and doesn’t use, the term “shadow profiles.” because it sounds like Facebook creates hidden profiles for people who haven’t joined the network, which Facebook says it doesn’t do. Ofcourse the company is not being honest about this, as I just explained.

Most users remain unaware of the reach and power of the”shadow profiles”. Because shadow-profile connections happen inside Facebook’s algorithmic black box, people can’t see how deep the data-mining of their lives truly is, until an uncanny recommendation pops up.

Scary examples: (quotes from Gizmodo)

  • A man who years ago donated sperm to a couple, secretly, so they could have a child—only to have Facebook recommend the child as a person he should know. He still knows the couple but is not friends with them on Facebook.
  • A social worker whose client called her by her nickname on their second visit, because she’d shown up in his People You May Know, despite their not having exchanged contact information.
  • A woman whose father left her family when she was six years old—and saw his then-mistress suggested to her as a Facebook friend 40 years later.
  • An attorney who wrote: “I deleted Facebook after it recommended as PYMK a man who was defense counsel on one of my cases. We had only communicated through my work email, which is not connected to my Facebook, which convinced me Facebook was scanning my work email.”

As expected, Facebook does what it can to underplay how much data it gathers through contacts, and how widely it casts its net. “People You May Know suggestions may be based on contact information we receive from people and their friends,” Facebook spokesperson Matt Steinfeld wrote in an email.

So how do you stop Facebook from collecting data? Contact every person you know who ever received your contact information and uploaded it to Facebook and ask them to go to Facebook’s contact management page and delete it. That is really the only way.

Just don’t miss anyone. “Once a contact is deleted, we remove it from our system, but of course it is possible that the same contact has been uploaded by someone else,” Steinfeld wrote in an email.

Sources: BoingBoingGizmodo

Sharing is caring...
Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInPin on PinterestShare on RedditShare on StumbleUponDigg thisShare on TumblrShare on VKFlattr the authorShare on YummlyBuffer this pageEmail this to someonePrint this page

SQL injection tutorial – A step by step guide (4 parts)

Are you interested in learning about hacking? Perhaps you imagined hacking a website and uploading your own custom message to it? Today we want to introduce you to SQL injection. The guide below comes in 4 parts and takes you from beginner to advanced in less than an hour. The final part is about uploading a shell as an image.

Remember, these tutorials are for educational purposes only.

SQL injection tutorial – A step by step guide – Part 1:

SQL injection tutorial – A step by step guide – Part 2:

SQL injection tutorial – A step by step guide – Part 3:

SQL injection tutorial – A step by step guide – Part 4:

Sharing is caring...
Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInPin on PinterestShare on RedditShare on StumbleUponDigg thisShare on TumblrShare on VKFlattr the authorShare on YummlyBuffer this pageEmail this to someonePrint this page

Million Mask March 2017 – The day activists and hackers unite and march together

There is one day each year that is special to both activists and hackers. Every year on that day they unite and march together, all over the world, to fight against censorship and oppression. They are united by hiding their faces, walking anonymously through each big city, showing the world they exist.

It started small, a few years ago, with an operation called #OpVendetta, created by the collective of Anonymous. This collective is often portrayed by the media as being some sort of shady hacker group, but really Anonymous is just an idea. Everyone can be anonymous and it doesn’t have any members or leaders. People involved with Anonymous hide their identities, for safety reasons, but also to be united as one. To show they do not act as seperate entities, but rather as one big block.

Over the years the operation once known as #OpVendetta became famous as the Million Mask March. The name #OpVendetta ofcourse refers to the movie V for Vendetta, wich ends with thousands of people marching while wearing their Guy Fawkes masks. It became a symbol for global protest in large numbers. Nowadays the Million Mask March attracts thousands, some say millions, of activists all over the world. Mostly marching in their capital cities, but marches also exist in smaller cities.

The protest marches do not carry any group opinion. It is said that you can join the march for whatever reason you want. Most of the activists march for their freedom, and to combat censorship. But it is not necessarily limited to that. The last few years there are many animal rights activists as well, for example. What unites everyone is the concept of anonymity.

Do you want to know if there is a march close to you? The easiest thing you can do is go to Facebook, then type Million Mask March Yourcityname to find a march you can visit. Also search for the hashtags #millionmaskmarch or #mmm2017 on Instagram or Twitter. You will see many people advertising their marches or talking about this subject. Even if you don’t plan to march, it is truly an event that touches the hearts of everyone.

Sharing is caring...
Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInPin on PinterestShare on RedditShare on StumbleUponDigg thisShare on TumblrShare on VKFlattr the authorShare on YummlyBuffer this pageEmail this to someonePrint this page

The Antikythera Mechanism – The 2000 year old computer

Often when we study ancient cultures we automatically assume that we are way ahead of them, and that they were not much advanced. We treat them as “barbarians” without an evidence for it. However, sometimes an artifact is found proving quite the opposite. This article is about one of those artifacts, called the Antikythera Mechanism.

For many decades, scientific investigation failed to yield much data and relied more on imagination than the facts. However, research over the last half century has begun to reveal its secrets. The single most information-rich machine, dated as around the end of the 2nd century B.C., is the most sophisticated mechanism known in the ancient world. Nothing as complex is known for the next thousand years. The shoe-box size bronze mechanism had its inscriptions barely readable, and its 30 bronze gears bearing thousands of interlocking tiny teeth were calcified when it was uncovered from the shipwreck at Antikythera, Greece, in 1901. The underwater excavation revealed beautiful bronze sculptures, ropes of decadent jewelry and a treasure trove of antique coins.

The reconstruction of the Antikythera Machine

X-Ray analysis of  the Antikythera Machine made by ancient Greek scientists and increasingly looking like the “philosopher’s guide to the galaxy,” as the Associated Press described it, revealed a text of a long explanatory “label” which helped us to understand it was dedicated to an astronomical phenomena and operated as a complex mechanical “computer” which tracked the cycles of the Solar System. It had dials that counted the days according to at least three different calendars, and another that could be used to calculate the timing of the Olympics. In addition to two rectangular plates that could be called front and back dials, there was an inscription which showed annually repeating astronomical events relating to the Sun and to fixed stars. While lunar eclipse related text probably ran down one side of the plate, and that for solar eclipse prediction down the other.

The front dial was surrounded by two scales, one representing the zodiac, the other the Egyptian calendar year. Pointers representing the stars and planets revolved around its front face, indicating their position in relation to Earth. The back plate has two large spiral dials. A tiny, painted model of the moon rotated on a spindly axis, flashing black and white to mimic the real moon’s movements. On this face, the upper five-turn Metonic Dial which included ‘Games’ dial represented a 235-lunar-month calendrical cycle while the lower four-turn Saros Dial including Exeligmos Dial represented a 223-lunar-month eclipse prediction cycle. It was planned as a 76-year “Kallippic” calendrical cycle.  The Games dial alone shows six Olympic competitions. The machine clearly showed the motion of planetary systems, possibly including Venus and Saturn as well.

Before the discovery of the device, researchers thought such technology had not existed for 1,000 years after.

All known fragments of the Antikythera Mechanism are currently held for research at the National Archaeological Museum in Athens.

Watch the documentary here:

Do you want to learn more about this amazing find? We recommend to read up on Wikipedia. There are also great articles about it that gives you a lot of information.

Find the wikipedia article here:
https://en.wikipedia.org/wiki/Antikythera_mechanism

The official website about this subject can be found here:

http://www.antikythera-mechanism.gr/project/overview

The scientific definition of the article can be reached here:  http://www.hpdst.gr/publications/almagest/issues/7-1

Further reading:

https://www.washingtonpost.com/news/speaking-of-science/wp/2016/06/14/the-worlds-oldest-computer-is-still-revealing-its-secrets/?utm_term=.265401683740

http://www.independent.co.uk/news/science/world-s-oldest-computer-used-to-read-the-stars-and-tell-the-future-new-study-reveals-a7079616.html

http://www.euronews.com/2016/06/22/is-this-2000-year-old-tool-the-world-s-oldest-computer

Sources: Youtube, Wikipedia

Sharing is caring...
Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInPin on PinterestShare on RedditShare on StumbleUponDigg thisShare on TumblrShare on VKFlattr the authorShare on YummlyBuffer this pageEmail this to someonePrint this page

Microsoft Engineer installs Google Chrome when Microsoft Edge crashes during presentation – Hilarious!

Microsoft presenter Michael Leworthy was doing a presentation showing the new features of Microsoft Azure. While doing his presentation suddenly the web browser Microsoft has been presenting as the best browser in the world, Edge, crashed. Leworthy was forced to install Google Chrome to finish his presentation.

While people in the audience were giggling, the Microsoft engineer tries to continue presenting like nothing happened. It shows, however, how Microsoft (and other companies) have been struggling to keep up with Google. Chrome is the most popular web browser in the world, leaving the competition far behind.

Michael Leworthy was man enough to upload the presentation himself, showing Microsoft does have some sense of humour. Then again, the presentation does not say anything negative about Azure. So if the video goes viral, they might still get some sales from it.

Watch the full presentation below below. The funny stuff happens at around 37 minutes:

Microsoft, once known as the most powerful tech company in the world, has been struggling to regain its focus. Their operating systems are still the most widely used, but they seem to be having some issues with their other products.

Bad business moves, like replacing Windows Live Messenger with Skype, or continuing to change the name of the most popular e-mail service in the world, Hotmail, did not do them any good either. Especially because they did this during the rise of Gmail, causing Google to take the take their territory on the market at an amazing speed.

We honestly hope that some day Microsoft will become the giant that it once was, again. And if not, then at least we got some funny videos like the one above. That is worth something as well.

Sources: The Hacker News, Youtube

Sharing is caring...
Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInPin on PinterestShare on RedditShare on StumbleUponDigg thisShare on TumblrShare on VKFlattr the authorShare on YummlyBuffer this pageEmail this to someonePrint this page

WPA2 Security Flaw – KRACK-Key Installation Attack

Recently new administrative vulnerabilities were discovered in the WPA2 security protocol, which is a 13-year-old WiFi authentication method to secure WiFi associations and still the most common used system for computers, phones and routers.

According to ZDNet, this security flaw affects our homes, organizations and system administration organizations that manufacture them as well.Such a security flaw threatens the safety of data like passwords, and personal information like chatlogs, photographs and credit cards.

Mathy Vanhoef of imec-DistriNet, KU Leuven discovered that the attack called “KRACK-Key Reinstallation Attack” works by exploiting a 4-way handshake of the WPA2 protocol.

Video with proof of concept:

For a KRACK attack to be successful, an already-in-use key is re-installed by tricking the victim. That leads to the manipulation and replay of cryptographic handshake messages.

When the attacker is within physical range of a vulnerable device, network traffic could be decrypted, connections could be hijacked, and any content could be injected into the traffic stream. Simply said: The attack allows new devices with a pre-shared password to join the network. This flaw, if exploited, gives an attacker a skeleton key to access any WPA2 network without a password.

Microsoft Windows and the latest versions of Apple’s iOS are largely immune from the flaws, according to security researcher Kevin Beaumont, in a blog post. However, Vanhoef said the security issue is “exceptionally devastating” for Android 6.0 Marshmallow and above.

Although security experts said it wasn’t clear if any attacks had been seen in the wild, over an insecure network sites and services with HTTPS traffic will encrypt the data from the browser to the server.

The warning was uncovered around the time of the Black Hat security conference, when Vanhoef presented a talk on networking protocols, with a focus on the Wi-Fi handshake that authenticates a user joining a network.
The cyber-emergency unit has since reserved 10 common vulnerabilities and exposures (CVE) records. Those can be found here.

Krack, as it is called on the internet right now, shows us that for over 13 years while everyone believed they were securely browsing the internet, they were not. And it is just an example of something that is uncovered, but who knows what is still to come? It is another reason why you should always be vigilant and stay up to date with security issues. Because no one else will do it for you.

Sources: ZDnet

Sharing is caring...
Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInPin on PinterestShare on RedditShare on StumbleUponDigg thisShare on TumblrShare on VKFlattr the authorShare on YummlyBuffer this pageEmail this to someonePrint this page

Microsoft internal bug database hacked in 2013 and silence followed

Microsoft’s internal database for bug tracking was hacked over 4 years ago. The hack was already discovered in 2013 but was never disclosed to the public. The hacked database contained a list of secret security flaws and possible exploits within its widely used software. They managed to fix the issue within months after that. However, something that is disturbing is that the public was never informed. During the months Microsoft was creating solutions to combat the possible exploits, the public was exposed to numerous threats without knowing about it.

The company checked to see if the leaked information had been used in other breaches around that same time, before Microsoft was able to patch them. According to insiders they were unable to link the hack to any other breaches happening before that. Since then the company has put more emphasis on internal security and former employees state that hacks like this will probably not occur anymore in the future.

But the fact remains the public should have been informed, even if it meant that the hackers likely would have used the exploits more aggressively since they knew the hack was discovered. If the public had been informed about what happened, companies, users and even governments could have taken preventative measures to ensure their security. The fact that Microsoft didn’t disclose that the breach occurred isn’t a great move at all.

“Bad guys with inside access to that information would literally have a ‘skeleton key’ for hundreds of millions of computers around the world,” said Eric Rosenbach, the U.S. deputy assistant secretary of defense for cyber at the time.

The dangers posed by information on such software vulnerabilities became a matter of broad public debate this year, after a National Security Agency stockpile of hacking tools was stolen, published and then used in the destructive “WannaCry” attacks against U.K. hospitals and other facilities.

Only one breach of a big database from a software company has been disclosed. In 2015, the nonprofit Mozilla Foundation – which develops the Firefox web browser – said an attacker had gotten access to a database that included 10 severe and unpatched flaws. One of those flaws was then leveraged in an attack on Firefox users, Mozilla disclosed at the time.
In contrast to Microsoft’s approach, Mozilla provided extensive details of the breach and urged its customers to take action.

Sources: Engadget, Reuters

Sharing is caring...
Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInPin on PinterestShare on RedditShare on StumbleUponDigg thisShare on TumblrShare on VKFlattr the authorShare on YummlyBuffer this pageEmail this to someonePrint this page