Transcript
Jim Love (0:03)
Mozilla tackles the car industry After a Volkswagen data breach exposes sensitive data of 800,000 electric cars the Upper Canada school board is hit by a data breach. Mastercard's lack of transparency over a security flaw sparks some criticism and hackers get hacked. A fake malware builder tricks 18,000 script kiddies. This is Cybersecurity today. I'm your host Jim Love. A major data breach at Volkswagen exposed the location data of 800,000 electric cars in 2024, raising serious concerns about privacy. The breach also tied this information to personal data affecting Volkswagen, Audi, Seat and Skoda drivers. The breach resulted from a typical item, a misconfigured Amazon cloud database, leaving terabytes of sensitive data, including precise location, histories and contact details, vulnerable online for several months. A whistleblower brought the issue to light, and Volkswagen's team fixed the problem in late 2024, but the damage was already done. This incident is part of a larger debate over privacy in the automotive industry. Mozilla has criticized carmakers for invasive data practices, calling them the worst product category for privacy. Mozilla says it underscores a far more troubling reality. Car companies are brazenly collecting vast amounts of data about drivers through a web of sensors, microphones, cameras and the phones, apps and other connected services in your car. Mozilla's advocacy has led to regulatory action, including an FTC warning in the US to carmakers and new rights for drivers to delete their data. Mozilla is now urging consumers to demand stronger protections through a petition they are circulating for listeners concerned about privacy. It's a reminder to question what data your car collects and to support initiatives pushing for transparency in data practices. There's a link to Mozilla's petition in the show. Notes A data breach at the Upper Canada District School Board has exposed sensitive personal and financial information. The breach, discovered on January 18, compromised names, addresses and even in some cases, banking details. The school board is investigating the full extent of the breach, but officials have warned that the leaked information could lead to identity theft. Cybersecurity experts in law enforcement have been engaged to assess and address the situation while affected individuals are receiving notifications. Data breaches in public institutions like schools are becoming more common. They have extremely sensitive data and often have outdated systems and a lack of resources in their small IT departments. So it makes schools, as well as healthcare and other civic infrastructure easy targets, and as a result, they're facing more and more attacks. In the case of the schools, parents are probably still reeling from the earlier power schools attack that exposed the records of school children throughout North America. In these cases, parents need to push for transparency about the threats, demand assistance with monitoring, but they also have to take time to educate their children on online risks now that their data is exposed. This is also a wake up call to all levels of government that public institutions have to do more to protect sensitive data as they remain prime targets for cybercriminals. MasterCard is under fire for its handling of a cybersecurity issue involving a domain name system or DNS misconfiguration. The error, which went unnoticed for years, was first reported by Krebs on security. It stems from a DNS error that could have allowed unauthorized access to MasterCard systems. A security researcher discovered the vulnerability and responsibly disclosed it to the company. Instead of expressing gratitude and providing clear technical details, MasterCard's official response minimized the incident, claiming no risk had been identified and omitting credit to the researcher. Rather than letting this exposure remain, our researcher bought the domain name that was the source of the potential attack vector. It had been registered but abandoned by a Russian, presumably a hacker, because the domain was in a foreign country. It cost our researcher some of his own money and a lot of time. Once the threat was neutralized, the researcher, having had no meaningful reaction from mastercard, published his findings as a researcher might. But here's the kicker. Rather than crediting the researcher or providing detailed insights, mastercard again attempted to minimize the issue, claiming no significant risk was identified. In fact, mastercard wrote to him asking him to take down his post, and seemed to imply that his posting was somehow unprofessional. While they made no threat in this case, an official letter from a large company is always something that any individual has to take seriously. This isn't how things should be done. Transparency is critical in cybersecurity. Companies like Google and Microsoft have set the standard with bug bounty programs and open collaboration with researchers. Mastercard's response, which seems to be about seeking to make the story disappear, is not only the wrong approach, but it risks alienating the cybersecurity community and eroding public trust. The incident underscores the importance of transparency in addressing vulnerabilities. Companies should use these moments to showcase accountability and foster trust rather than downplaying risks. Or, as one person put it, it's a good reason not to use marketing staff to do cybersecurity or breach communications. In an ironic twist, a hacker has turned the tables on 18,000amateur cybercriminals, known in the industry as script kiddies by distributing a fake malware builder to them. Instead of helping them launch ransomware attacks, the tool infected the users themselves, turning their own malicious intent into a field lesson in irony. The tool was advertised as a simple solution for creating ransomware, promising inexperienced hackers the ability to deploy attacks with minimal effort. However, rather than generating malicious software, the builder delivered its own malware, infecting those who downloaded it. Cybersecurity researchers revealed the hackers campaign effectively turned the tables on the script kiddies, exploiting their eagerness to commit cybercrime without the skills to do it themselves. Script kiddies and other relatively unsophisticated hackers often rely on pre made tools to carry out their cyber attacks. And more sophisticated hackers rely on this large pool of I'll say talent in quotes, but it allows the more sophisticated hackers to develop the tools while others do the dirty work and take the risks. I've compared it to a franchise operation, only a criminal one. It's very effective and it has fueled an explosion in phishing, ransomware and other attacks. But in the case of the script kiddies, it turns out it also makes them easy targets for experienced hackers. And who do you complain to when the software you downloaded to attack someone attacks you? Maybe it's the new 11th Commandment hack, not lest ye also be hacked. And that's our show for today. You can reach me with comments, questions, tips or even constructive criticism at editorialechnewsday ca. I'm your host Jim Love. Thanks for listening.