{"id":22205,"date":"2022-04-29T08:03:16","date_gmt":"2022-04-29T12:03:16","guid":{"rendered":"https:\/\/www.itworldcanada.com?p=481729"},"modified":"2022-04-29T15:07:53","modified_gmt":"2022-04-29T19:07:53","slug":"cyber-security-today-april-29-2022-breast-cancer-website-leaves-data-open-a-warning-on-microsoft-explorer-and-facebook-privacy-controls-questioned","status":"publish","type":"post","link":"https:\/\/technewsday.com\/staging\/cyber-security-today-april-29-2022-breast-cancer-website-leaves-data-open-a-warning-on-microsoft-explorer-and-facebook-privacy-controls-questioned\/","title":{"rendered":"Cyber Security Today, April 29, 2022 \u2013 Breast cancer website leaves data open, a warning on Microsoft Explorer and Facebook privacy controls questioned"},"content":{"rendered":"<p>Breast cancer website leaves data open, a warning on Microsoft Explorer and Facebook privacy controls questioned.<\/p>\n<p>Welcome to Cyber Security Today. It\u2019s Friday April 29th, 2022. I\u2019m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com.<\/p>\n<p><iframe style=\"border: none;\" title=\"Libsyn Player\" src=\"https:\/\/html5-player.libsyn.com\/embed\/episode\/id\/22943333\/height\/90\/theme\/custom\/thumbnail\/yes\/direction\/forward\/render-playlist\/no\/custom-color\/000000\/\" width=\"100%\" height=\"90\" scrolling=\"no\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<table style=\"width: 100%;\">\n<tbody>\n<tr>\n<td><a href=\"https:\/\/www.amazon.com\/ITWC-Cyber-Security-Today\/dp\/B07BRNG89P\/ref=sr_1_1?s=digital-skills&amp;ie=UTF8&amp;qid=1522688435\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-396718 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2017\/09\/sub-alexa-200.png\" alt=\"Cyb er Security Today on Amazon Alexa\" width=\"200\" height=\"74\" border=\"none\"><\/a><\/td>\n<td><a href=\"https:\/\/www.google.com\/podcasts?feed=aHR0cDovL2N5YmVyc2VjdXJpdHl0b2RheS5saWJzeW4uY29tL3Jzcw%3D%3D\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" loading=\"lazy\" class=\"thumbnail aligncenter wp-image-408712 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2018\/09\/sub-gp-200.png\" alt=\"Cyber Security Today on Google Podcasts\" width=\"200\" height=\"74\"><\/a><\/td>\n<td><a href=\"https:\/\/itunes.apple.com\/ca\/podcast\/cyber-security-today\/id1363182054\" rel=\"noopener noreferrer\"><img loading=\"lazy\" decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-396720 size-full\" src=\"https:\/\/i.itworldcanada.com\/wp-content\/uploads\/2017\/09\/sub-itunes-200.png\" alt=\"Subscribe to Cyber Security Today on Apple Podcasts\" width=\"200\" height=\"74\" border=\"none\"><\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<p><strong>Another misconfigured bucket of data<\/strong> stored in the cloud has been found. This time it held data and images of people by Breastcancer.org. It\u2019s an American non-profit with a website that offers free research to women and men on breast cancer. It also has discussion forums people can subscribe to. In a report released this week <a href=\"https:\/\/www.safetydetectives.com\/news\/breastcancer-leak-report\/#review-1\" rel=\"noopener\">researchers at SafetyDetectives found<\/a> said last year they found an open Amazon S3 bucket holding 150 GB of data with over 350,000 files. Some of the files were user avatars, which are real or sketched pictures forum users can put beside their real or assumed names. Others were images posted with their comments in the forums. However, some digital images have what\u2019s called EXIF data that can include general location information, such as where an image was shot. That could lead to the real identities of people being tracked down, say the researchers. Some data also included results of medical tests. In addition to this being a privacy problem the researchers say Breastcancer.org didn\u2019t reply to warning messages. Ultimately researchers had to Amazon as well as the U.S.Computer Emergency Response Team to get the data secured. Two lessons from this incident: Organizations must have a combination of policies and IT procedures to ensure sensitive data employees have access to is locked down. And they need procedures for taking seriously email, phone and text complaints about security-related problems.<\/p>\n<p><strong>IT administrators allowing<\/strong> employees to use Microsoft\u2019s Internet Explorer browser need to know threat actors are hunting for versions that haven\u2019t patched a year-old vulnerability. The warning comes from <a href=\"https:\/\/www.bitdefender.com\/files\/News\/CaseStudies\/study\/415\/Bitdefender-PR-Whitepaper-RedLine-creat6109-en-EN.pdf\" rel=\"noopener\">security researchers at Bitdefender.<\/a> Attackers are using the vulnerability to install the RedLine Stealer trojan. This is malware that steals passwords, credit card information and other sensitive data. This vulnerability was patched in March, 2021. There is no reason why companies, or individuals, should still be using an old version of any browser. Individuals should check once a week to make sure their browser is running the latest version.<\/p>\n<p><strong>Does Facebook<\/strong> have full control over the data of its users? Can it make privacy promises to users and reguators? No, say some employees. That\u2019s according to a document written last year and seen by reporters at Motherboard. Authored by Facebook privacy engineers on the Ad and Business Product team, it says Facebook can\u2019t confidently make controlled policy changes or external commitments such as \u2018we will not use X data for Y purpose.\u2019 The problem, says the letter, is privacy regulators expect Facebook to make promises like that. A Facebook spokesperson replied the company has extensive processes and controls to comply with privacy regulations. <a href=\"https:\/\/www.vice.com\/en\/article\/akvmke\/facebook-doesnt-know-what-it-does-with-your-data-or-where-it-goes\" rel=\"noopener\">There\u2019s a link here to the article,<\/a> so can you read it and judge yourself.<\/p>\n<p><strong>Finally<\/strong>, later today look for the Week in Review edition of the podcast. My guest is Terry Cutler, head of Montreal\u2019s Cyology Labs. We\u2019ll discuss the Lapsus$ extortion gang\u2019s tactics, ransomware attacks on Costa Rica and a list of favourite vulnerabilities exploited last year by hackers.<\/p>\n<p>Remember links to details about podcast stories are in the text version at ITWorldCanada.com. That\u2019s where you\u2019ll also find other stories of mine.<\/p>\n<p>Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.<\/p>\n<p>The post <a href=\"https:\/\/www.itworldcanada.com\/article\/cyber-security-today-april-29-2022-breast-cancer-website-leaves-data-open-a-warning-on-microsoft-explorer-and-facebook-privacy-controls-questioned\/481729\">Cyber Security Today, April 29, 2022 \u2013 Breast cancer website leaves data open, a warning on Microsoft Explorer and Facebook privacy controls questioned<\/a> first appeared on <a href=\"https:\/\/www.itworldcanada.com\/\">IT World Canada<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This episode reports on a misconfigured Amazon data bucket, a warning on an old Microsoft Explorer bug being exploited and Facebook&#8217;s privacy controls questioned<\/p>\n<p>The post <a href=\"https:\/\/www.itworldcanada.com\/article\/cyber-security-today-april-29-2022-breast-cancer-website-leaves-data-open-a-warning-on-microsoft-explorer-and-facebook-privacy-controls-questioned\/481729\">Cyber Security Today, April 29, 2022 \u2013 Breast cancer website leaves data open, a warning on Microsoft Explorer and Facebook privacy controls questioned<\/a> first appeared on <a href=\"https:\/\/www.itworldcanada.com\/\">IT World Canada<\/a>.<\/p>\n","protected":false},"author":17,"featured_media":20695,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[360,361,16],"tags":[389,488],"class_list":["post-22205","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-podcasts","category-privacy","category-security","tag-cyber-security-today","tag-pocasts"],"acf":[],"_links":{"self":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/22205","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/comments?post=22205"}],"version-history":[{"count":3,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/22205\/revisions"}],"predecessor-version":[{"id":22214,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/posts\/22205\/revisions\/22214"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/media\/20695"}],"wp:attachment":[{"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/media?parent=22205"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/categories?post=22205"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/technewsday.com\/staging\/wp-json\/wp\/v2\/tags?post=22205"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}