InfoSecBulletin Cybersecurity for mankind
Researchers from Duke University conducted a data brokerage project. They reached out to 12 data brokers and purchased information from three of them. The brokers were selling various types of data, including health, financial, contact information, family member details, net worth, and religion. It’s important to note that none of this data was deanonymized.
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
Alert
Trend Micro Apex One Flaw Allow Attackers to Inject Malicious Code
Researchers purchased data on approximately 5,000 active-duty military personnel from a single broker. The data included various information such as their name, home and email addresses, political affiliation, gender, age, income, net worth, credit rating, presence of children in their home, marital status, home value, and religion. The cost per military servicemember was only $0.213.
Data brokers selling military staff data could be a national security threat, says Justin Sherman from Duke’s Sanford School of Public Policy. Sherman explains that data brokers collect information on almost all Americans, including high-ranking members of the military and other national security agencies. This raises concerns about the potential risks to national security.
Foreign actors benefit from the lack of privacy regulations in the US. Companies are already collecting and organizing personal data, including sensitive and private information. This data could be used for bribery and blackmail, as stated by Sherman.
ALSO READ:
Researchers at Duke University found that buying data was not only affordable, but it was also simple due to the lack of background checks or authentication. The researchers demonstrated that brokers were willing to send potentially sensitive data on defense employees to foreign entities by using a .asia email address and servers based in Singapore.
The brokers gather information from many different sources. When asked, the companies did not disclose where they obtained the data. Some said it came from mobile apps and medical records, while others claimed to have received it from nonprofits.
While the data trade is, for the most part, entirely legal, Sherman believes the laws around the industry need strengthening. “Some think of data brokers as only third-party companies, but it’s important to understand just how many first-party collectors of data, such as mobile apps on our phones, may turn around and sell data about us to data brokers,” Sherman added.
Aden Klein, a senior at Duke and co-author of the report, stated that data brokers have weak controls. These controls are more concerned with getting paid and protecting themselves from liability rather than preventing the sale of data on servicemembers or others.
According to the report, there were some protections in place regarding the sale of geolocation information. One broker mentioned that they would not sell this data to individuals near “sensitive” locations, but were willing to sell it for individuals anywhere else in the U.S.
