Information Technology

Around 1.75 billion sensitive files were leaked by a Brazilian e-commerce integrator that provides services to some of the country’s largest online shopping websites.Hariexpress is headquartered in São Paulo and integrates multiple processes into a single platform to improve the efficiency and operational capability of retailers with more than one e-commerce store. Some of the company’s clients include Magazine Luiza, Mercado Livre, Amazon and B2W Digital. The national postal service, Correios, is also among the company’s partners and was also impacted by the incident.

According to security researcher Anurag Sen at Safety Detectives, who discovered the leak in July 2021, the incident is attributed to a misconfigured and unprotected ElasticSearch server and involves more than 610GB of exposed data. The researchers noted they were unsuccessful in their attempts to resume communication with the company after an initial contact. Banking information relating to customers was not compromised, according to the experts; on the other hand, the leak exposed a vast set of sensitive information including customers’ full names, e-mail addresses, business and residential addresses, company registration and social security numbers. In addition, all manner of details relating to purchases including dates, times and prices of products sold, as well as copies of invoices and login credentials to the Hariexpress service were also exposed, according to Safety Detectives. The researchers could not estimate the exact number of impacted users, due to the amount of duplicate email addresses found in the exposed set of data, but it is estimated that several thousands of users were potentially affected by the leak.Moreover, it is not possible to tell whether other parties had access to the data, according to the researchers. The experts warned that the data set, which contains information that directly identifies users of marketplaces integrated by the company, could be used in phishing and social engineering attacks. The report also warned about the potential for other types of crimes such as burglaries, as the data exposed includes residential and business addresses and extortion, since the information also includes purchases of intimate products. Contacted by ZDNet, the company did not respond to requests for comment. Brazil’s National Data Protection Agency was also contacted for comment on the case and had not responded at the time of publication. More

Regulators in Ireland have proposed up to $42 million in fines for Facebook after the company was accused of violating the GDPR through deceptive data collection policies. Privacy expert Max Schrems and his advocacy group nyob — which submitted the original complaint against Facebook — published a draft decision from the Irish Data Protection Commission (DPC) about the issue that was sent to the other European Data Protection Authorities.The decision suggests a fine of between $32 million and $42 million for Facebook’s violations of the GDPR, which include a failure to notify its customers about how it uses their data. Schrems and other privacy experts slammed the proposed fine for its relatively minuscule size and for the legal arguments Facebook is making to get out of more strict fines. Nyob said Facebook’s argument is effectively that it is exempt from most GDPR rules because of a minor change in its agreement with users.”Facebook’s legal argument is rather simple: By interpreting the agreement between user and Facebook as a ‘contract’ (Article 6(1)(b) GDPR) instead of ‘consent’ (Article 6(1)(a) GDPR) the strict rules on consent under the GDPR would not apply to Facebook — meaning that Facebook can use all data it has for all products it provides, including advertisement, online tracking and alike, without asking users for freely given consent that they could withdraw at any time,” nyob explained in a blog post. “Facebook’s switch from ‘consent’ to ‘contract’ happened on 25.5.2018 at midnight — exactly when the GDPR came into effect in the EU.”

Schrems said it is painfully obvious that Facebook is trying to bypass the rules of the GDPR by relabeling the agreement on data use as a ‘contract’. If this is accepted by regulators, any company could simply write the processing of data into a contract and thereby legitimize any use of customer data without consent, Schrems explained.”This is absolutely against the intentions of the GDPR, that explicitly prohibits to hide consent agreements in terms and conditions,” Schrems said. Nyob noted that studies have shown users do not see the website’s terms of service as a contract. A Gallup Institute survey said just 1.6% of respondents saw the agreement they make with Facebook when they sign up for the site as a “contract.” More than 63% said they see the agreement as consent.Schrems and nyob also made charged claims in the blog post, writing that representatives from Facebook and the DPC met in 2018 and created a way for Facebook to get around certain GDPR regulations.He went on to explain that regulators were fining Facebook for “not being transparent” about how it processes data but still expressed support for the company’s “consent bypass.”Both Facebook and the DPC did not respond to requests for comment.”The DPC developed the ‘GDPR bypass’ with Facebook that it is now greenlighting as a regulator. Instead of a regulator, it acts as a ‘big tech’ advisor,” Schrems said. “Basically the DPC says Facebook can bypass the GDPR, but they must be more transparent about it. With this approach, Facebook can continue to process data unlawfully, add a line to the privacy policy and just pay a small fine, while the DPC can pretend they took some action.”Schrems also took issue with how the DPC analyzed nyob’s complaint, criticizing the regulators for omitting key parts of their submission and refusing oral hearings. The draft was sent to other data protection authorities across Europe and will now be reviewed. Regulators from other countries can submit complaints, which will then be handled by the European Data Protection Board. The board can overrule decisions made by Irish regulators. WhatsApp was slapped with a 225 million euro fine last month after a GDPR investigation found that the platform was not transparent about how it shared data with its parent company, Facebook. In that case, Irish regulators faced similar backlash for the initial 50 million euro fine. The European Data Protection Board overruled the DPC and increased it significantly. “Our hope lies with the other European authorities. If they do not take action, companies can simply move consent into terms and thereby bypass the GDPR for good,” Schrems said. Privacy expert Cillian Kieran told ZDNet the fine mentioned in the draft is just one-hundredth of the possible fine under GDPR. Kieran also took issue with how the DPC represented Facebook’s position and the core tenets of their argument. He said that there needs to be consistent legal definitions designed into the technical systems themselves. “How can the fine in the draft decision, an amount which Facebook recovers in revenue within less than 5 hours on average, possibly be dissuasive? Much of the decision goes into countering allegations that Facebook violated consent requirements. The decision argues that consent is not necessary in this situation, nullifying any issues of consent. This points to a serious disparity in how authorities, advocates, and end-users like the complainant view the principles of processing under GDPR,” Kieran said. “Maybe if the Irish DPC did not form a bottleneck on dozens of GDPR investigations, we would be getting these vital interpretations on consent and other legal bases sooner than three and a half years after GDPR takes effect. I agree with Schrems that this decision is disappointing and inadequate, both in the fine and in the interpretation of contracts versus consent.”

more on GDPR More

Digital marketers are wildly bullish on dream tech — playing ads right before people sleep to influence dreams — and 39% of consumers are open to the technology too, according to a survey.The American Marketing Association-New York’s 2021 Future of Marketing Survey canvased the marketing technology landscape relative to 2019’s report. Overall, consumers are beginning to accept new marketing technology, but worried about privacy. What caught my eye in the survey was dream-tech, which was opposed by 32% of consumers, supported by 39% with the remainder falling in the don’t know category. Given this dream-tech concept wasn’t around in 2019, the favorability rating is a bit stunning. Here’s how favorability among consumers stacks up across marketing channels. Add it up and consumers are accepting of personalized ads (54% in favor); IoT devices (53%) and AI assistants (60%). Virtual reality headsets are viewed favorably by 61% of consumers and augmented reality devices checked in at 49%. In other words, dream-tech is off to a good start with consumers even if the definition of it remains a bit murky.The report also looked at marketers’ expectations and what technologies would be adopted at scale. The kicker: 77% of marketers declared that they would deploy more dream-tech in the next three years. That tally topped smart speakers and IoT devices. I can’t wait to see how this consumer vs. marketing adoption off dream-tech plays out. Here’s a guess: Facebook figures out who looks at the app before bed and hits you with something to influence your dreams. Congressional hearings will ensue — again — but at least Facebook is used to it.  One area of agreement was data collection and how it’s a privacy issue. Consumers would limit data collection to email, age and name and marketers generally agreed. Marketers were more comfortable with collecting location than consumers. Fifty-four percent of marketers want to collect location data and only 41% of consumers want to part with it.  More

Photo by Daniel Romero on Unsplash
One of the things most interesting about the Android OS is the wide variety of devices it’s available in. Sure, there are Android phones and tablets. But Android also functions inside most recent Chromebooks and now — improbably, but in a fully supported way — Windows 11 devices, even Intel-based Windows 11 computers. That diversity of deployment makes the Android implementations of VPN clients particularly interesting. If, for example, you want to run a VPN on your Chromebook, your best bet is to install an Android VPN client and let that client do all the heavy lifting. We discussed that in-depth in our Best VPN for Chrome and Chromebooks 2021 guide. Unfortunately, the more open environment of Android means that there are many different implementations, versions aren’t regularly updated, and as this interesting piece by the NordVPN folks shows, malware is more prevalent. That makes inherent malware scanning within the VPN client particularly helpful. In this overview, we look at four of the most popular Android VPNs. Here’s what we think:

4.3 Google Play Store average, 446K ratings

Family Sharing: YesMalware Scanner: YesSimultaneous Connections: 6Kill Switch: YesPlatforms: Windows, Mac, iOS, Android, Linux, Android TV, Chrome, FirefoxLogging: None, except billing dataCountries: 59Servers: 5517Trial/MBG: 30 dayAlso: How does NordVPN work? Plus how to set it up and use itNordVPN is one of the most popular consumer VPNs out there. Last year, Nord announced that it had been breached. Unfortunately, the breach had been active for more than 18 months. While there were failures at every level, NordVPN has taken substantial efforts to remedy the breach.Also: My in-depth review of NordVPNIn our review, we liked that it offered capabilities beyond basic VPN, including support of P2P sharing, a service it calls Double VPN that does a second layer of encryption, Onion over VPN which allows for TOR capabilities over its VPN, and even a dedicated IP if you’re trying to run a VPN that also doubles as a server. It supports all the usual platforms and a bunch of home network platforms as well. The company also offers NordVPN Teams, which provides centralized management and billing for a mobile workforce.Also: My interview with NordVPN management on how they run their servicePerformance testing was adequate, although ping speeds were slow enough that I wouldn’t want to play a twitch video game over the VPN. To be fair, most VPNs have pretty terrible ping speeds, so this isn’t a weakness unique to Nord. Overall, a solid choice, and with a 30-day money-back guarantee, worth a try.

4.3 Google Play Store average, 220K ratings

Family Sharing: YesMalware Scanner: NoSimultaneous Connections: 5 or unlimited with the router appKill Switch: YesPlatforms: A whole lot (see the full list here)Logging: No browsing logs, some connection logsCountries: 94Locations: 160Trial/MBG: 30 daysExpressVPN has been burning up the headlines with some pretty rough news. We’ve chosen to leave ExpressVPN in this recommendation, and I wouldn’t necessarily dismiss ExpressVPN out of hand because of these reports, but it’s up to you to gauge your risk level. The best way to do that is read our in-depth analysis:ExpressVPN is one of the most popular VPN providers out there, offering a wide range of platforms and protocols. Platforms include Windows, Mac, Linux, routers, iOS, Android, Chromebook, Kindle Fire, and even the Nook device. There are also browser extensions for Chrome and Firefox. Plus, ExpressVPN works with PlayStation, Apple TV, Xbox, Amazon Fire TV, and the Nintendo Switch. There’s even a manual setup option for Chromecast, Roku, and Nvidia Switch.Must read:With 160 server locations in 94 countries, ExpressVPN has a considerable VPN network across the internet. In CNET’s review of the service, staff writer Rae Hodge reported that ExpressVPN lost less than 2% of performance with the VPN enabled and using the OpenVPN protocol vs. a direct connection.While the company does not log browsing history or traffic destinations, it does log dates connected to the VPN service, amount transferred, and VPN server location. We do want to give ExpressVPN kudos for making this information very clear and easily accessible.Exclusive offer: Get 3 extra months free.

4.2 Google Play Store average, 15K ratings

Family Sharing: YesMalware Scanner: NoSimultaneous Connections: UnlimitedKill Switch: YesPlatforms: Windows, Mac, iOS, Android, Linux, Chrome, plus routers, Fire Stick, and KodiLogging: None, except billing dataServers: 1,500 Locations: 75Trial/MBG: 30 dayIPVanish is a deep and highly configurable product that presents itself as a click-and-go solution. I think the company is selling itself short doing this. A quick visit to its website shows a relatively generic VPN service, but that’s not the whole truth.Also: My in-depth review of IPVanishIts UI provides a wide range of server selection options, including some great performance graphics. It also has a wide variety of protocols, so no matter what you’re connecting to, you can know what to expect. The company also provides an excellent server list with good current status information. There’s also a raft of configuration options for the app itself.In terms of performance, connection speed was crazy fast. Overall transfer performance was good. However, from a security perspective, it wasn’t able to hide that I was connecting via a VPN — although the data transferred was secure. Overall, a solid product with a good user experience that’s fine for home connections as long as you’re not trying to hide the fact that you’re on a VPN.The company also has a partnership with SugarSync and provides 250GB of encrypted cloud storage with each plan.

4.0 Google Play Store average, 36K ratings

Family Sharing: YesMalware Scanner: YesSimultaneous Connections: UnlimitedKill Switch: YesPlatforms: Windows, Mac, Linux, iOS, Android, Fire TV, Firefox, ChromeLogging: None, except billing dataTrial/MBG: 30 dayAt two bucks a month for a two-year plan (billed in one chunk), Surfshark offers a good price for a solid offering. In CNET’s testing, no leaks were found (and given that much bigger names leaked connection information, that’s a big win). The company seems to have a very strong security focus, offering AES-256-GCM, RSA-2048, and Perfect Forward Secrecy encryption. To prevent WebRTC leaks, Surfshark offers a special purpose browser plugin designed specifically to combat those leaks.Must read:Surfshark’s performance was higher than NordVPN and Norton Secure VPN, but lower than ExpressVPN and IPVanish. That said, Surfshark also offers a multihop option that allows you to route connections through two VPN servers across the Surfshark private network. We also like that the company offers some inexpensive add-on features, including ad-blocking, anti-tracking, access to a non-logging search engine, and a tool that tracks your email address against data breach lists.

Will these apps work on all Android devices?

Probably not. Unfortunately, many Android-based devices are not updated to the latest Android releases and have no update path. Sadly, some vendors even ship brand-new devices running older (and far more vulnerable) versions of Android. Generally, VPN vendors make sure their clients run on the most recent and a few previous versions of Android, but since there are still a tremendous number of devices in service running very out-of-date Android, it’s unlikely those will be able to run these apps. That’s why it’s good to take advantage of the money-back offerings and test your download shortly after purchase.

What’s the difference between anti-malware software and VPN software?

While both technologies are intended to protect you and your device, they protect different aspects of your usage. VPNs fundamentally protect data-in-motion, that is the data being sent to and from the internet. The protection they generally offer is encryption, so hackers can spy on the data while it moves. Anti-malware software protects against execution of bad software on your device. Those apps often scan inside the data as it comes into your machine, look at the apps on your machine, and intercept the actions of apps while they’re running on your machine.As an analogy, think of VPN software as an armored car moving a payload from one location to another in safety. Think of anti-malware as building inspectors constantly looking at your building’s infrastructure to see if there’s any, say, mold and as gatekeepers, checking everything that passes through to make sure it’s not harmful.

Why do I even need a VPN on my phone?

This question is often asked by people who know their phone’s data runs through their local carrier, which is moderately hard for hackers to intercept. And, generally, if you’re using your carrier’s LTE or 5G connection, you’re reasonably safe. But carriers have data caps and data carriage fees that can get expensive. Even if you have an unlimited data plan, carriers charge for hotspot use (ask me how I know, or how much that pisses me off). The way around that is to use whatever local Wi-Fi is available. Many coffee shops, airport lounges, hotels, and schools offer free Wi-Fi access. Unfortunately, that Wi-Fi is often open and easy to intercept. A big (and very important) use of VPNs on phones is to protect your data when you’re accessing the internet through one of these hotspots. In fact, I’d go so far as to say never, ever access the internet through a Wi-Fi hotspot without an active VPN on your device.

You can follow my day-to-day project updates on social media. Be sure to follow me on Twitter at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, and on YouTube at YouTube.com/DavidGewirtzTV. More

An international scam ring is targeting dating app users in a romance scam to not only deprive victims of their cryptocurrency but also the control of their handsets. 

On Wednesday, Sophos cybersecurity researchers named the gang “CryptoRom” and said they have recently expanded their operations from Asia, spreading to both the United States and Europe.  Romance scams are an insidious and constant problem, and thanks to the rising popularity of dating apps, are now not only limited to phishing emails. Instead, fraudsters will ‘match’ with their victims, pretend interest until they build a foundation of trust, and then they will ask for money — only to vanish soon after. In recent years, romance scams have become more sophisticated, with some cybercriminals offering their victims ‘exclusivity’ in trading deals or in cryptocurrency investments, using the lure of easy profit as well as potential love matches.  Interpol warned of an uptick in investment-based romance fraud taking place across dating apps in January this year.  The CryptoRom scam artists target iPhone users of dating apps including Tinder and Bumble. One tactic used is to lure victims into downloading a fake cryptocurrency trading app that gives the operators remote control over the handset.  The researchers say this has been made possible by abusing Apple’s Enterprise Signature platform, used by software developers to test out iOS apps ahead of submission to the App Store. 

Victims are asked to purchase cryptocurrency through Binance and then transfer the funds to a wallet via the fake trading app. Matches are pointed to fraudulent websites that mimic the look and feel of the legitimate App Store — likely in the hope they won’t look at the address bar too closely and they will install a malicious app.  “At first, the returns look very good but if the victim asks for their money back or tries to access the funds, they are refused and the money is lost,” explained Jagadeesh Chandraiah, Senior threat researcher at Sophos. “Our research shows that the attackers are making millions of dollars with this scam.”
Sophos
Unfortunately, it seems the group is competent, as a wallet controlled by them contains close to $1.4 million in cryptocurrency, thought to have been stolen from victims who fell for their tactics and who invested their cash into crypto. However, there could easily be more than one wallet in use.  As Enterprise Signature allows developers to test out app functionality, the fake apps are also able to perform other functions such as data theft, account compromise, as well as potentially download and execute other payloads.  Sophos reached out to Apple with its findings but at the time of writing has not received a response.  “To avoid falling victim to these types of scams, iPhone users should only install apps from Apple’s App Store,” Chandraiah cautioned. “The golden rule is that if something seems risky or too good to be true — such as someone you barely know telling you about some ‘great’ online investment scheme that will deliver a big profit  — then sadly, it probably is.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Sophos has released a new report this week about a dating app scam that led to the theft of millions of dollars from people on Tinder, Bumble, Grindr, Facebook Dating and similar apps.After gaining their trust on these dating apps, scammers convinced victims to download fake crypto apps, where they duped them into investing money before freezing the accounts. The scammers were somehow able to easily game Apple’s Developer Enterprise program — and the Apple Enterprise/Corporate Signature — to distribute these fraudulent crypto apps, which were masquerading as Binance and other legitimate brands. Sophos said its threat hunters observed the scammers abusing Apple’s Enterprise Signature to manage victims’ devices remotely.Apple did not respond to requests for comment. Sophos also contacted Apple about the issue and did not get a response. 
Sophos
Named “CryptoRom,” according to Sophos researchers Jagadeesh Chandraiah and Xinran Wu, the scam has led to at least $1.4 million being stolen from victims in the US and EU. In their report, the two say that the attackers moved beyond going after victims in Asia and instead are now targeting people in Europe and the US. Sophos researchers even managed to find a Bitcoin wallet that was being controlled by the attackers thanks to one victim, who shared the address he initially sent the money to before being shut out. Chandraiah said the CryptoRom scam relies heavily on social engineering at almost every stage. Victims came to Sophos to discuss the scam and the researchers found other reports of people being taken advantage of. 

“First, the attackers post convincing fake profiles on legitimate dating sites. Once they’ve made contact with a target, the attackers suggest continuing the conversation on a messaging platform,” Chandraiah said. “They then try to persuade the target to install and invest in a fake cryptocurrency trading app. At first, the returns look very good but if the victim asks for their money back or tries to access the funds, they are refused and the money is lost. Our research shows that the attackers are making millions of dollars with this scam.”Victims are initially contacted on apps like Bumble, Tinder, Facebook dating and Grindr before the conversation is moved to other messaging apps. From there, the conversation is steered toward getting victims to install fake trading applications onto their devices. Once a victim is drawn in, they are asked to invest a small amount before being locked out of accounts if they demand their money back. 

see also

Best VPN services

Virtual private networks are essential to staying safe online — especially for remote workers and businesses. Here are your top choices in VPN service providers and how to get set up fast.

Read More

The attack is two-pronged, giving cybercriminals the ability to steal money from victims and gian access to their iPhones. According to Wu and Chandraiah, the attackers are able to use “Enterprise Signature” — a system built for software developers that assists enterprises with pre-test new iOS applications with selected iPhone users before they submit them to the official Apple App Store for review and approval. “With the functionality of the Enterprise Signature system, attackers can target larger groups of iPhone users with their fake crypto-trading apps and gain remote management control over their devices. This means the attackers could potentially do more than just steal cryptocurrency investments from victims. They could also, for instance, collect personal data, add and remove accounts, and install and manage apps for other malicious purposes,” the researchers said. Chandraiah added that until recently, criminal operators mainly distributed the fake crypto apps through fake websites that resemble a trusted bank or the Apple App Store.”The addition of the iOS enterprise developer system introduces further risk for victims because they could be handing the attackers the rights to their device and the ability to steal their personal data,” Chandraiah said.”To avoid falling victim to these types of scams, iPhone users should only install apps from Apple’s App Store. The golden rule is that if something seems risky or too good to be true – such as someone you barely know telling you about some ‘great’ online investment scheme that will deliver a big profit  – then sadly, it probably is.”Sophos published another report on a similar scam in May that was aimed solely at people in Asia. But over the last few months the researchers saw a startling expansion of the attacks. “This scam campaign remains active, and new victims are falling for it every day, with little or any prospect of getting back their lost funds. In order to mitigate the risk of these scams targeting less sophisticated users of iOS devices, Apple should warn users installing apps through ad hoc distribution or through enterprise provisioning systems that those applications have not been reviewed by Apple,” the two researchers wrote. “And while institutions dealing with cryptocurrency have started implementing ‘know your customer’ rules, the lack of wider regulation of cryptocurrency will continue to draw criminal enterprises to these sorts of schemes, and make it extremely difficult for victims of fraud to get their money back. These scams can have have a devastating effect on the lives of their victims.” More

Apple has defended its position on the restriction of app sideloading in light of current EU discussions surrounding competition in the tech space.

On Wednesday, the iPad and iPhone maker published a new paper (.PDF) on sideloading, a process allowed by other mobile OS developers — such as Google, albeit with some friction — to install apps on devices outside of official app repositories. Sideloading can be useful when users want access to software that is not available in official stores. Users may want to install apps that have been discontinued or when newer versions are not compatible with an existing handset, or for whatever reason — such as legal battles — an app has been pulled from an official source.  However, there are caveats to this practice. If you bypass an official store such as Google Play, Apple’s App Store, or the Microsoft Store, you may be missing out on the security protections and verification in place for an app to be hosted, and, therefore, you may be exposing yourself to mobile malware.  In June, Apple chief executive Tim Cook claimed that sideloading was not in the best interests of Apple product users, and reviewing all apps introduced into the ecosystem keeps mobile malware rates low.  “Mobile malware and the resulting security and privacy threats are increasingly common and predominantly present on platforms that allow sideloading,” Apple says.  There are a number of ways that malware can reach a handset. On occasion, malicious apps can circumvent existing protections in an official app repository; but more commonly, apps can be spread through phishing, masquerading as legitimate software or OS updates, and website spoofing. 

According to Apple’s research paper, “Building a Trusted Ecosystem for Millions of Apps: A threat analysis of sideloading,” — which builds upon a paper published in June — there are far more malware infections on Android-based devices than on iPhones. These infections include ad fraud software, spyware, Trojans, ransomware variants, and fake apps that could result in the theft of data or funds. The research has been published in light of discussions in Europe concerning the Digital Services Act (DSA) and the Digital Markets Act (DMA). The EU’s proposals would require tighter controls on “illegal” content online and for “gatekeepers” — such as tech and service providers — to protectively preserve and permit competition.  As previously reported by ZDNet, this could include measures such as increased interoperability between services and third-party software and banning the prevention of uninstalling pre-installed apps on mobile devices by users.  According to the Center for Strategic & International Studies, the DMA could force vendors such as Apple and Google to facilitate sideloading in the future.  While renewed regulation could be a positive force, there may be not enough discussion concerning the security of mobile device users, and the ramifications of taking away their choice to purchase a handset contained in a closed — and, therefore, potentially safer — mobile ecosystem.  Apple says that if the company was forced to support sideloading, even if limited to “third-party app stores only,” this would increase the spread of harmful applications as these sources may not have sufficient vetting procedures.Apple claims that users would end up with less control over their apps and features including parental controls, accessibility, and app tracking transparency would be negatively impacted. In addition, Apple says that users could end up being forced to sideload apps due to work or school.  “Some sideloading initiatives would also mandate removing protections against third-party access to proprietary hardware elements and non-public operating system functions,” Apple says. “This would undermine core components of platform security that protect the operating system and iPhone data and services from malware, intrusion, and even operational flaws.” The tech giant added: “Forcing Apple to support sideloading on iOS through direct downloads or third-party app stores would weaken these layers of security and expose all users to new and serious security risks: It would allow harmful and illegitimate apps to reach users more easily; it would undermine the features that give users control over legitimate apps they download; and it would undermine iPhone on-device protections.  Sideloading would be a step backward for user security and privacy: supporting sideloading on iOS devices would essentially turn them into “pocket PCs,” returning to the days of virus-riddled PCs.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Critical security issues in the OpenSea NFT marketplace that allowed attackers to steal cryptocurrency wallet funds have been patched. 

NFTs, also known as non-fungible tokens, are digital assets that can be sold and traded on the blockchain. While some NFTs — from a pixel cartoon to a popular meme — can reach a sale price of millions of dollars, the popularity of this phenomenon has also created a new attack vector for exploitation.  On Wednesday, the Check Point Research (CPR) team said that flaws in the OpenSea NFT marketplace could have allowed “hackers to hijack user accounts and steal entire crypto wallets of users, by sending malicious NFTs.” An investigation was launched after reports surfaced of malicious NFTs, airdropped for free, being used as conduits for cryptocurrency theft and account hijacking.  The NFT itself, and the airdrop, was not the source of the issue. Instead, once an NFT had been gifted to a potential victim, they would view it — and then a pop-up would trigger, requesting a signature to connect to a wallet. A secondary signature request prompt would then appear, and if accepted, could grant attackers access to an unwitting user’s wallet, funds, and more.  In OpenSea’s case, the security flaw allowed the team to upload an .SVG file containing a malicious payload, which would execute under the OpenSea storage subdomain. “In our attack scenario, the user is asked to sign with their wallet after clicking an image received from a third party, which is unexpected behavior on OpenSea, since it does not correlate to services provided by the OpenSea platform, like buying an item, making an offer, or favoring an item,” CPR says. “However, since the transaction operation domain is from OpenSea itself, and since this is an action the victim usually gets in other NFT operations, it may lead them to approve the connection.”

The researchers disclosed their findings to OpenSea on September 26. Within less than an hour, the marketplace had triaged and verified the security issues and deployed a fix.  In a statement, OpenSea said: “Security is fundamental to OpenSea. We appreciate the CPR team bringing this vulnerability to our attention and collaborating with us as we investigated the matter and implemented a fix within an hour of it being brought to our attention.  These attacks would have relied on users approving malicious activity through a third-party wallet provider by connecting their wallet and providing a signature for the malicious transaction.” OpenSea added that the organization has not found any evidence of exploitation in the wild. Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More