Tag Archives: NRLPA:ODAT

Amazon-owned Twitch says source code exposed in last week’s data breach

A twitch sign-in screen is seen at the offices of Twitch Interactive Inc, a social video platform and gaming community owned by Amazon, in San Francisco, California, U.S., March 6, 2017. REUTERS/Elijah Nouvelage

Oct 15 (Reuters) – Amazon.com Inc-owned (AMZN.O) Twitch said on Friday that last week’s data breach at the live streaming e-sports platform contained documents from its source code.

Passwords, login credentials, full credit card numbers and bank details of users were not accessed or exposed in the breach, Twitch said in a statement.

The platform, which is used by video gamers for interacting with users while live streaming content, had blamed the breach on an error in the server configuration change.

Server configuration changes are performed during server maintenance. A faulty configuration can expose the data stored in the servers to unauthorized access.

Twitch said it was “confident” the incident affected only a small number of users and that it was contacting those who had been directly impacted. The platform has more than 30 million average daily visitors.

Video Games Chronicle had reported that about 125 gigabytes of data was leaked in the breach, including details on Twitch’s highest-paid video game streamers since 2019.

Reporting by Chavi Mehta and Eva Mathews in Bengaluru; Editing by Aditya Soni

Our Standards: The Thomson Reuters Trust Principles.

Read original article here

Facebook could face hefty fine in Russia over banned content, says regulator

MOSCOW, Sept 30 (Reuters) – Russian authorities on Thursday warned social media giant Facebook (FB.O) it faces a fine of up to 10% of its annual turnover in the country unless it deletes content Moscow deems illegal.

Upping the ante in its standoff with U.S. Big Tech, state communications regulator Roskomnadzor told Reuters it was planning to send Facebook’s representatives in Russia an official notification saying it had repeatedly failed to remove banned information.

That, it said, could lead to a fine of 5% or 10% of Facebook’s annual Russian turnover unless the situation is remedied.

Facebook’s violations include failing to remove posts containing child pornography, drug abuse and extremist content, the Vedomosti daily reported separately.

Facebook had no immediate comment.

Moscow has increased pressure on foreign tech companies over the last year as part of a long-running push to assert greater sovereignty over its segment of the internet, including efforts to make companies store Russians’ personal data on its territory.

On Wednesday, Russia threatened to block YouTube, owned by Alphabet Inc. (GOOGL.O), after the video-hosting giant removed Russian state-backed broadcaster RT’s German-language channels from its site. read more

A 3D-printed Facebook logo is seen placed on a keyboard in this illustration taken March 25, 2020. REUTERS/Dado Ruvic/Illustration/File Photo/File Photo

Read More

Earlier this year, Roskomnadzor wrote to Facebook and other social media firms demanding they remove posts containing calls for minors to participate in anti-government protests after the arrest of Kremlin critic Alexei Navalny.

Vedomosti cited experts who estimated Facebook’s annual Russian turnover at around 12 billion roubles ($165 million).

Reuters could not immediately verify that estimate.

Roskomnadzor has opened 17 different administrative cases against Facebook this year for failing to delete banned content, court documents showed, with 64 million roubles owed in fines or pending.

A turnover fine would dwarf those levied so far.

“Facebook’s administration has not paid the fines,” Vedomosti cited Roskomnadzor as saying.

(This story has been refiled to remove extraneous word in lede)

($1 = 72.5975 roubles)

Editing by Barbara Lewis, Elaine Hardcastle, Kirsten Donovan

Our Standards: The Thomson Reuters Trust Principles.

Read original article here

Google CEO sought to keep Incognito mode issues out of spotlight, lawsuit alleges

Sept 24 (Reuters) – Google Chief Executive Sundar Pichai in 2019 was warned that describing the company’s Incognito browsing mode as “private” was problematic, yet it stayed the course because he did not want the feature “under the spotlight,” according to a new court filing.

Google spokesman José Castañeda told Reuters that the filing “mischaracterizes emails referencing unrelated second and third-hand accounts.”

The Alphabet Inc (GOOGL.O) unit’s privacy disclosures have generated regulatory and legal scrutiny in recent years amid growing public concerns about online surveillance.

Users last June alleged in a lawsuit that Google unlawfully tracked their internet use when they were browsing Incognito in its Chrome browser. Google has said it makes clear that Incognito only stops data from being saved to a user’s device and is fighting the lawsuit.

In a written update on trial preparations filed Thursday in U.S. district court, attorneys for the users said they “anticipate seeking to depose” Pichai and Google Chief Marketing Officer Lorraine Twohill.

The attorneys, citing Google documents, said Pichai “was informed in 2019 as part of a project driven by Twohill that Incognito should not be referred to as ‘private’ because that ran ‘the risk of exacerbating known misconceptions about protections Incognito mode provides.'”

The filing continued, “As part of those discussions, Pichai decided that he ‘didn’t want to put incognito under the spotlight’ and Google continued without addressing those known issues.”

Castañeda said teams “routinely discuss ways to improve the privacy controls built into our services.” Google’s attorneys said they would oppose efforts to depose Pichai and Twohill.

Last month, plaintiffs deposed Google vice president Brian Rakowski, described in the filing as “the ‘father’ of Incognito mode.” He testified that though Google states Incognito enables browsing “privately,” what users expect “may not match” up with the reality, according to the plaintiffs’ write-up.

Google’s attorneys rejected the summary, writing that Rakowski also said terms including “private,” “anonymous,” and “invisible” with proper context “can be super helpful” in explaining Incognito.

Reporting by Paresh Dave; Editing by David Gregorio

Our Standards: The Thomson Reuters Trust Principles.

Read original article here

Indonesia probes suspected data breach on COVID-19 app

People wearing protective face masks queue up to receive a vaccine dose against the coronavirus disease (COVID-19) during a mass vaccination program at a shopping mall in Jakarta, Indonesia, August 31, 2021. REUTERS/Ajeng Dinar Ulfiana

JAKARTA, Aug 31 (Reuters) – Indonesia is investigating a suspected security flaw in a COVID-19 test-and-trace app that left exposed personal information and the health status of 1.3 million people, a health ministry official said on Tuesday.

Researchers from encryption provider vpnMentor said personal information in the Indonesia Health Alert Card (eHAC) app, often required to be used by travellers, was accessible “due to the lack of protocols put in place by the app’s developers.”

Anas Ma’ruf, a health ministry official overseeing data, said the government was looking into the potential breach, but said the potential flaw was in an earlier version of the app, which has not been used since July.

“The eHAC from the old version is different from the eHAC system that is a part of the new app,” he said. “Right now, we’re investigating this suspected breach”.

The eHAC system is now part of the Peduli Lindungi (Care Protect) app, which the government has promoted for various tracing purposes, including entry at malls.

Anas urged people to delete the old app and said the breach might have originated from a partner, without elaborating. He said the current eHAC system was now managed by the government and its safety was “guaranteed”.

VpnMentor researchers said the flaw could expose people to phishing or hacking, as well as discourage people from using a COVID-19 tracing app.

Experts say such data breaches point to Indonesia’s weak cyber security infrastructure. In May, authorities also launched an investigation into an alleged breach of social security data from the country’s state insurer. read more

Reporting by Stanley Widianto; Editing by Ed Davies

Our Standards: The Thomson Reuters Trust Principles.

Read original article here

Policy groups ask Apple to drop plans to inspect iMessages, scan for abuse images

Aug 19 (Reuters) – More than 90 policy and rights groups around the world published an open letter on Thursday urging Apple (AAPL.O) to abandon plans for scanning children’s messages for nudity and the phones of adults for images of child sex abuse.

“Though these capabilities are intended to protect children and to reduce the spread of child sexual abuse material, we are concerned that they will be used to censor protected speech, threaten the privacy and security of people around the world, and have disastrous consequences for many children,” the groups wrote in the letter, which was first reported by Reuters.

The largest campaign to date over an encryption issue at a single company was organized by the U.S.-based nonprofit Center for Democracy & Technology (CDT).

Some overseas signatories in particular are worried about the impact of the changes in nations with different legal systems, including some already hosting heated fights over encryption and privacy.

“It’s so disappointing and upsetting that Apple is doing this, because they have been a staunch ally in defending encryption in the past,” said Sharon Bradford Franklin, co-director of CDT’s Security & Surveillance Project.

An Apple spokesman said the company had addressed privacy and security concerns in a document Friday outlining why the complex architecture of the scanning software should resist attempts to subvert it.

Those signing included multiple groups in Brazil, where courts have repeatedly blocked Facebook’s (FB.O) WhatsApp for failing to decrypt messages in criminal probes, and the senate has passed a bill that would require traceability of messages, which would require somehow marking their content. A similar law was passed in India this year.

“Our main concern is the consequence of this mechanism, how this could be extended to other situations and other companies,” said Flavio Wagner, president of the independent Brazil chapter of the Internet Society, which signed. “This represents a serious weakening of encryption.”

Other signers were in India, Mexico, Germany, Argentina, Ghana and Tanzania.

Surprised by the earlier outcry following its announcement two weeks ago, Apple has offered a series of explanations and documents to argue that the risks of false detections are low.

Apple said it would refuse demands to expand the image-detection system beyond pictures of children flagged by clearinghouses in multiple jurisdictions, though it has not said it would pull out of a market rather than obeying a court order.

Though most of the objections so far have been over device-scanning, the coalition’s letter also faults a change to iMessage in family accounts, which would try to identify and blur nudity in children’s messages, letting them view it only if parents are notified.

The signers said the step could endanger children in intolerant homes or those seeking educational material. More broadly, they said the change will break end-to-end encryption for iMessage, which Apple has staunchly defended in other contexts.

“Once this backdoor feature is built in, governments could compel Apple to extend notification to other accounts, and to detect images that are objectionable for reasons other than being sexually explicit,” the letter says.

Other groups that signed include the American Civil Liberties Union, Electronic Frontier Foundation, Access Now, Privacy International, and the Tor Project.

Reporting by Joseph Menn; Editing by Edwina Gibbs

Our Standards: The Thomson Reuters Trust Principles.

Read original article here