expert-profile | Information Security Buzz

Expert(s): November 30, 2020

Kristina Balaam

Senior Security Intelligence Engineer feature_status*/ ?>

Lookout

Comments Dotted : 1

November 25, 2020

Comment: Baidu Caught Collecting Sensitive Details From Android Users

It’s important to be mindful of the permissions an application requests.

SDKs that attempt to collect sensitive information about the device are not terribly uncommon; many advertising SDKs do this in order to serve more relevant ads to users. However, it’s important to be mindful of the permissions an application requests so that a user may know exactly what kind of data they might be sharing with a corporation, advertising SDK or developer. In the case of Baidu Maps and Baidu Search Box, the applications are asking for the “READ_PHONE_STATE” permission. In.....Read More

SDKs that attempt to collect sensitive information about the device are not terribly uncommon; many advertising SDKs do this in order to serve more relevant ads to users. However, it’s important to be mindful of the permissions an application requests so that a user may know exactly what kind of data they might be sharing with a corporation, advertising SDK or developer. In the case of Baidu Maps and Baidu Search Box, the applications are asking for the “READ_PHONE_STATE” permission. In versions of the operating system prior to Android 10, “ READ_PHONE_STATE" protected the user from sharing certain unique, identifying data like the IMSI and IMEI without explicit permission. As Palo Alto Networks points out, details unique to the user like the IMSI and IMEI, and which are typically associated with the user’s SIM card, could be used to track the individual across devices. With Android 10, Google has limited device identifiers to system applications and those signed with a platform key. Read Less

Stephen Kapp, CTO and Founder, Cortex Insight

"Updating and patching systems should be a priority for schools and mandatory for their pupils. "

15 Schools Hit By Cyberattack In Nottinghamshire

Jake Moore, Cybersecurity Specialist, ESET

"In general, malicious actors now use full-blown extortion tactics to make sure they get what they came for in attacks like this. "

Qualys Hit With Ransomware And Customer Invoices Leaked

Ilia Kolochenko, CEO, ImmuniWeb

"Qualys’s response to the incident is a laudable example of transparent and professional handling of a security incident. "

Qualys Hit With Ransomware And Customer Invoices Leaked

Natalie Page, Cyber Threat Intelligence Analyst, Sy4 Security

"Due to the nature of this organisation, PrismHR makes for an extremely valuable target to an adversary looking to extract sensitive information. "

Experts Reaction On PrismHR Hit By Ransomware Attack

Lewis Jones, Threat Intelligence Analyst, Talion

"Ransomware renders any files it touches unreadable unless, and until, a victim pays for a digital key needed to unlock the encryption on them. "

Experts Reaction On PrismHR Hit By Ransomware Attack

Stephen Kapp, CTO and Founder, Cortex Insight

"An attack like this will not only impact PrismHR but also its customers who will need access to systems in order to pay employees. "

Experts Reaction On PrismHR Hit By Ransomware Attack

Richard Walters, CTO , Censornet

"“Careless clicks sink ships.” "

Expert Insight On Ryuk’s Revenge: Infamous Ransomware Is Back And Stronger Than Ever

Saryu Nayyar, CEO, Gurucul

"The evolution of the ObliqueRAT trojan is a good example of how malicious actors are constantly updating their tools and techniques. "

ObliqueRAT Trojan Lurks On Compromised Websites – Experts Comments

James McQuiggan, Security Awareness Advocate, KnowBe4

"It is essential to conduct red team or pen testing exercises. "

Experts Reaction On Malaysia Airlines 9 Years Old Data Breach

Nikos Mantas, Incident Response Expert, Obrela Security Industries

"Data security should be a priority for all organisations today. "

Experts Reaction On Malaysia Airlines 9 Years Old Data Breach

David Sygula, Senior Cybersecurity Analyst , CybelAngel

"Organisations must constantly scan for leaked documents outside the enterprise perimeter. "

Experts Reaction On Malaysia Airlines 9 Years Old Data Breach

Satnam Narang, Senior Research Engineer, Tenable

"We expect other threat actors to begin leveraging these vulnerabilities in the coming days and weeks. "

Microsoft Multiple 0-Day Attack – Tenable Comment

Sam Curry, Chief Security Officer, Cybereason

"Total transparency is needed and they need to hone in on more specific details and be completely transparent with Enrich members. "

Experts Reaction On Malaysia Airlines 9 Years Old Data Breach

Florian Thurmann, Technical Director, EMEA , Synopsys Software Integrity Group

"Your organisation won’t be able to determine which of their employees has made a given change in the system. "

Experts Reaction On Malaysia Airlines 9 Years Old Data Breach

Alan Grau, VP of IoT , Sectigo

"Best-practices for IoT device security include strong authentication and secure software updates. "

IoT Security In The Spotlight, As Research Highlights Alexa Security Flaws