user data Archives - Gizmochina

TikTok’s parent company ByteDance sued for collecting face scans & other sensitive data on CapCut

Sean — Thu, 03 Aug 2023 11:06:43 +0000

ByteDance, the parent company behind the popular TikTok app, was recently hit with a lawsuit that claimed that it is non-consensually collecting users’ biometric data. The lawsuit alleged that the illegal data privacy breach was from the company’s CapCut app.

Yet another data privacy breach from ByteDance

For those unaware, CapCut is a video editing application that has over 200 million active users. But apparently, this platform is collecting their sensitive private information without their consent. The lawsuit was filed in Illinois and claims that CapCut is violating the state’s Biometric Information Act. This breach is from collecting data like face scans and voice prints without informing the users.

Apart from biometrics, the app was reportedly collecting other private information like user location, gender, date of birth, and even gaining access to photos and videos. The primary focus of this invasive data collection is likely in regard to targeted ads. The lawsuit adds that the app is capable of even gaining access to the MAC address and SIM serial number as well. Apparently, CapCut’s privacy policy was intentionally designed to make it harder for users to understand.

In other words, the CapCut users aren’t giving their consent in a proper manner. ByteDance is also behind TikTok, which has faced various accusations over data privacy. Some reports have claimed that it is even harvesting user data in the US, in service of the Chinese government.

RELATED:

(Via)

The post TikTok’s parent company ByteDance sued for collecting face scans & other sensitive data on CapCut appeared first on Gizmochina.

Massive Twitter breach leaks data of millions of users

Sean — Tue, 29 Nov 2022 09:59:20 +0000

Twitter has been seeing some rocky roads in recent times. However, it seems that its troubles haven’t ended yet, with a massive data breach causing the private user data for millions of users being leaked.

The popular microblogging website had faced a data dump of sensitive identity information for over 5 million Twitter users. This sensitive information was later reportedly sold on the dark web. Now, another new report has revealed that the latest data dump is being offered for free, but this data breach is potentially more damaging than the last. The news arrives from a BleepingComputer report. This data leak contains “tens of millions of Twitter records.”

As per the report, the leak shares the user’s phone numbers, verified status, account names, Twitter IDs, biographies, and even their screen names. The original findings were first published by security researcher Chad Loder on Twitter. Although he was banned soon after on the platform for allegedly revealing this information. However, he has since migrated to Mastodon and shared his report there.

On his initial tweet, Loder stated that “I have just received evidence of a massive Twitter data breach affecting millions of Twitter accounts in EU and US. I have contacted a sample of the affected accounts and they confirmed that the breached data is accurate. This breach occurred no earlier than 2021.” BleepingComputer analyzed a sample of the break for more than 1.3 million phone numbers of Twitter users from France, which revealed that this breach is accurate. So it remains to be seen how the company responds to this data breach.

RELATED:

The post Massive Twitter breach leaks data of millions of users appeared first on Gizmochina.

VPN firms unlikely to comply with Indian government’s mandate

Sudhanshu — Tue, 10 May 2022 15:24:00 +0000

Last week, the Indian government issued an order which required VPN (Virtual Private Network) based companies to collect and provide it with user data.

The order, issued by the Computer Emergency Response Team (CERT-in), which is a department under the Ministry of Electronics and IT requires these companies to collect sensitive user data like IP addresses, usage patterns, etc, and store it for up to 5 years before eventually handing it over to the government whenever asked. Failing to comply with these orders can result in prison sentences of up to a year under Section 70B(7).

The government has stated that this move is aimed at “coordinate response activities as well as emergency measures with respect to cyber security incidents.”

As you can imagine, this is a direct step against data privacy. And it appears that major VPN companies operating in India are unlikely to comply with these orders according to recent statements issued by them.

Laura Tyrylyte, who is the security spokesperson for NordVPN said “We are committed to protecting the privacy of our customers, therefore, we may remove our servers from India if no other options are left.”

Express VPN also issued a statement saying “VPNs are critical for user safety and the preservation of user’s right to online privacy and are fundamentally opposed to any efforts to undermine such technologies.”

Shurfshark VPN’s legal head Gytis Malinauskas has said that “We operate only with RAM-only servers, which means that at this moment, even technically, we would not be able to comply with the logging requirements.

Going by the statements of these major VPN service providers and their firm stance against the Indian Government’s mandate, it could be possible that these companies might soon stop providing their services in India. The last date for complying with the CERT-in’s directive is June 27th, 2022, so stay tuned for more updates on the matter.

India issues new order that asks VPN firms to collect & supply it with user data

Sean — Thu, 05 May 2022 10:51:22 +0000

India has just issued a new order that appears to be a step against data privacy. The government is now asking VPN based companies to collect and provide it with user data.

According to an Entrackr report, the government wants Virtual Private Network firms to collect the user’s data for five years on their servers and then eventually hand it over to the government. This order is not limited to just VPN based companies and even targets Cloud and Crypto based firms as well. The report adds that firms that do not comply with this order may face prison sentence up to a year under the Section 70B(7). This order has been issues by a department under the Ministry of Electronics and IT, which is known as Computer Emergency Response Team (CERT-in).

The department has urged VPN companies to collect sensitive user data, which includes their customer’s names after validating them. Furthermore, they would even have to store other forms of information of the user like their IP addresses, usage patterns, and even other forms of identifiable information as well. All in all, the IT Ministry department stated that these efforts are being made to “coordinate response activities as well as emergency measures with respect to cyber security incidents.” However, this is a major step against data privacy since companies are now legally allowed and required to collect and store your data as per the new order.

The VPN, cloud, and crytpo based firms will begin collecting data starting from the date of 27th June 2021. So, the process is already underway. Unfortunately, many firms might face difficulties (especially VPN firms) that advertise their services with a no logs policy. Additionally, VPN users typically use the service to hide their original IP address and online footprint. This even helps in hiding their IP addresses from malicious individuals like hackers. So, collecting such user data defeats the purpose and makes data leaks more likely in the near future.

Apple reportedly shared user data with hackers that forged legal requests

Sean — Thu, 31 Mar 2022 08:25:58 +0000

Apple has allegedly provided a hacker group with user data. The company has apparently shared the data after the group had managed to forge legal requests documents for the information.

According to a Bloomberg report, three sources close to the matter revealed details regarding this incident, which was a part of a 2021 social engineering scam. Allegedly, the hackers had impersonated as law enforcement officials and were able to persuade the Cupertino based giant’s staff into sharing information regarding their customers’ addresses, phone numbers, and IP addresses as well. They managed to acquire this information after showing a forged “emergency data requests” document.

For those unaware, the iPhone maker usually provides the officials with such information only when a search warrant or subpoena from a judge is provided. However, this does not apply with emergency requests because they are known to be used only in cases of imminent danger. Unfortunately, Apple has yet to confirm if it actually shared the data with the hacker groups and directed Bloomberg to its law enforcement guidelines when asked to comment on the incident.

Similarly, it appears that Facebook’s parent company, Meta, also faced a similar situation as well. The tech giant also allegedly provided the same hacker group with user data and said after they said that they are working with law enforcement on the suspected fraudulent requests. The information acquired from the two companies could be used with malicious intent, like targeted harassment campaigns or even financial fraud schemes.

Xiaomi passes annual Data Privacy audit in compliance with the EU

Sean — Fri, 04 Feb 2022 12:15:45 +0000

Xiaomi had just announced the results of an independent review that was conducted for its data protection standards. The company passed the annual audit for data privacy, which was in compliance with the European Union.

The Chinese tech giant had brought in TRUSTe LLC, a subsidiary of TrustArc, for the independent audit of its data protection and security management system. Furthermore, this review had tested in details if the processing of personal information conducted by Xiaomi is in compliance with the General Data Protection Regulation (GDPR) of the European Union (EU). TRUSTe said in the review that “The measures described in the GDPR Validation Assessment were suitably designed to provide reasonable assurance,” with the review meeting all 40 GDPR validation requirements.

In a statement, the smartphone maker stated that its annual assessment has passed the standard with the European Union’s General Data Protection Regulation requirements. Xiaomi has been going through these annual audits by TrustArc since the regulation was first introduced back in 2018. The company also added that it will continue to maintain its high standards when it comes to user privacy and private data protection.

Cui Baoqiu, Vice President and Chairman of Xiaomi Security and Privacy Committee, said that “We regularly engage with TRUSTe, as well as other credible institutions globally to warrant that Xiaomi’s user privacy protection, including GDPR compliance, keeps improving and perfecting its practices to offer our users reliable and trustworthy products and services. I’m very pleased to see that Xiaomi has completed TRUSTe’s annual audit of GDPR privacy compliance, which demonstrates our commitment to privacy protection.”

WhatsApp & iMessage share the largest amount of user data to the FBI: Leaked Document

Sean — Wed, 01 Dec 2021 13:06:11 +0000

Smartphone users usually have a number of social media platform that they are active on daily. Out of these, there are specific apps that are geared for just messaging. While these apps may sometime contain sensitive information that the user wants to keep private, a leaked document has revealed that two major chatting apps, WhatsApp and iMessage, share quite a bit of data with the FBI.

According to a report from the Rolling Stone (Via AndroidAuthority), the news arrives from a leaked document from FBI (Federal Bureau of Investigation), which is a domestic intelligence and security based government service in the US. The document has revealed that Facebook’s WhatsApp and Apple’s iMessage provide the agency with the most amount of information, which it can legally obtain from any messaging application.

As per the document, WhatsApp, iMessage, and Line all offered “limited” message content over a legal request from the FBI. While these platforms willingly offered ‘some’ data, others like Signal, Telegram, Threema, Viber, WeChat, and Wickr did not disclose any message content. Although “limited” data doesn’t raise any alarms, the kind of information being shared might not be that harmless. The popular Android messaging app shares “only basic subscriber records” with a subpoena.

But in simpler terms, it means that the FBI is able to grab address book data from both the ‘target’ and their contacts if they have a search warrant. They can even track the source and destination of the messages sent from the app as well. Meaning, if you have saved the target’s contact info, your address book is also available for the FBI to snoop around in. This is even worse for the iMessage service. If iMessage users back up their messages on iCloud, the FBI has access to the actual message content as the Cupertino based giant is required to hand over iCloud encryption key with a search warrant.

Xiaomi investigates apps that violate its user data collection policies on the Mi Store

Sean — Wed, 14 Jul 2021 11:17:01 +0000

Earlier this week, Xiaomi officially announced that it would be conducting an investigation for applications in its Mi Store that have violated its policies regarding the collection of user data.

The Chinese tech giant shares notice of investigation for apps that have been illegally gathering and using personal information while also infringing on user rights and interests. For those unaware, there has been an emerging call from users regarding the frequent harassment and other issues regarding their personal information that has been infringed on Xiaomi’s application store, especially in China. The Mi Store has a large user base all across the globe, with its home market alone accounting for 90 million users.

So, it arrives as no surprise that certain apps target users’ data to get a more competitive edge over their rivals in the current market. In the past, user privacy and data collection policies have been scrutinized. Now, it seems that Xiaomi aims to weed out apps that have been harmful to its Mi Store users. Notably, the Chinese government is also working on reforming user data collection policies in the country, with the nation’s cyberspace regulator even ordering companies in China to delist Didi from their app stores. This was apparently due to Didi Global Inc illegally collecting users’ personal data.

In other words, Xiaomi is also joining in the efforts of its home country and is ordering app developers to reform data collection methods or face removal from its Mi Store. In the note, the brand said that it has received large amounts of feedback that have criticized apps on its platforms for their predatory data gathering practices. So, the company is springing into action, in compliance with the latest regulations from the Ministry of Industry and Information Technology.

Battlegrounds Mobile India is sending data to servers in China: Report

Sean — Mon, 21 Jun 2021 06:48:13 +0000

While Battlegrounds Mobile India has been a highly anticipated game, the upcoming battle royale title has also been facing a lot of scrutiny and calls for ban even prior to its release. Now, a new report has revealed that data from the Android version of the game was found being sent to servers in China.

According to an IGN report, the data regarding Indian users’ Android smartphones are being sent to a server in China. The data sent and received by the Battlegrounds Mobile India app are from China Mobile Communications servers in Beijing. This is a Tencent owned Proxima Beta in Hong Kong. Similarly, the data is also being sent to Microsoft Azure servers situated in the US, Mumbai, and Moscow.

The report added that these results were produced by simply installing a data packet sniffer app on your Android device. The app would then be able to find out which servers the smartphone is communication with. When checking the servers that the upcoming mobile game is connecting to, it was found that one of the servers was revealed to be run by China Mobile Communications Corporation, which is a Chinese state owned company. This server was located in Beijing, China.

I didn’t even have to play a game this time. pic.twitter.com/Xmb6Gnhj52

— rishi alwani (@RishiAlwani) June 20, 2021

Furthermore, one does not have to play a match either just to get these results. Apparently, Battlegrounds Mobile India also pings a Tencent server in Beijing as it begins booting up the game. This is major news considering Krafton Inc clearly states in its terms of service that the personal information of players would be stores and processed in servers that are based in India and Singapore. Although, it did add that it may “transfer your data to other countries” to meet “legal requirements.”

Over 500 million Facebook users’ phone numbers and personal data leaked

Sean — Mon, 05 Apr 2021 09:25:01 +0000

It has recently been found that the personal data and phone numbers of hundreds of millions of Facebook users has been leaked online. All of this information was posted on a low level hacking forum that was found recently.

According to a BusinessInsider report, the leaked data includes personal information and the phone numbers of 533 million users of the popular social media platform. The data is from about 106 countries, including information on 32 million users from the US, 11 million users from the UK, 6 million users from India, and more. In the leak, personal data includes the users phone numbers, Facebook IDs, full names, location, birth dates, bios, and even email addresses in certain cases.

As per a statement from Facebook spokesperson, the data found online is actually scrapped due to a vulnerability that the company had patched back in 2019. Although, despite the information being dated, the information could still provide valuable information to cybercriminals that can use this information to impersonate people and scam others to handover login credentials as well.

Alon Gal, CTO of cybercrime intelligence firm Hudson Rock stated that “A database of that size containing the private information such as phone numbers of a lot of Facebook’s users would certainly lead to bad actors taking advantage of the data to perform social engineering attacks [or] hacking attempts.” Gal further added that there is not much the company can do at this point as the information is already out in the open, but has advised users to be wary of phishing schemes or fraud.

Google receives 20 times more data from Android than Apple from iOS: Study

Sean — Wed, 31 Mar 2021 08:34:35 +0000

Its been known for a while now that iPhones or Android smartphones send user data back to Google or Apple. But now, a new study has revealed that the former receives as much as 20 times more data from Android than the latter from its iOS platform.

According to a ArsTechnica report, researcher Douglas Leith from Trinity College in Ireland provided side by side comparisons that suggests that Google’s Android collects a lot more information than Apple’s iOS. As per Douglas, transmit telemetry data that are sent to the tech giants collect information like whether a user has logged in or has configured privacy settings to opt out of certain options regarding data collection. Both iOS and Android also send data to the companies when a user does simple tasks like inserting a SIM card or browsing the smartphones screen settings and more.

The study also found that even when the device is idle, these devices connects back to its end server on an average of every 4.5 minutes or so. Collecting data and sending it back to these companies are not strictly restricted to just the operating systems and are also a common occurrence from preinstalled apps and services in smartphones. These apps also made connections even when they hadn’t used or opened.

While, the iOS automatically sent Apple data from Siri, Safari, and iCloud, Android collected data from Chrome, YouTube, Google Docs, Safetyhub, Google Messenger, the device clock, and the Google search bar. Notably, a Google spokesperson has contested these findings and stated that the study was based on faulty methods for measuring the data that’s collected by each OS. The spokesperson added that data collection is a core part of any internet connected device.

Telegram and Signal see millions of new downloads after recent WhatsApp privacy changes

Sean — Wed, 13 Jan 2021 11:00:06 +0000

After the recent WhatsApp privacy changes went live, the userbase numbers of its alternatives Signal and Telegram have surged almost immediately. In just a short span, both messaging platforms have seen millions of new users download their respective applications.

Talking about Signal first, the messaging app has seen a large influx of new users, with the company seeing new downloads nearing a million every day. For those unaware, Facebook recently updates its privacy policy for WhatsApp and other platforms, which has led it to receive a lot of criticism over its users’ data security and privacy. Since then, many have switched over to alternatives like Signal, which saw over 810,000 downloads just last Sunday alone. This marked a near 18 fold growth in just a week, as per an ETNews report.

For those unaware, WhatsApp’s latest privacy policy has the company reserve the right to share user data, including location, phone number, with its parent company Facebook and its other social media platforms like Instagram and Messenger. Similar to Signal, Telegram has also seen a massive influx of new users, with the platform seeing 25 million new downloads in just the past 72 hours. Out of this figure, 38 percent of all new users are from Asia.

Other regions like Europe account for 27 percent, while Latin America and MENA regions account for 21 percent and 8 percent respectively. With the world becoming more privacy conscious, the move from WhatsApp has basically led to a mass exodus from the app to other platforms, which offer better privacy standards and user data protection. It remains to be seen how WhatsApp responds to its current predicament.

The post Telegram and Signal see millions of new downloads after recent WhatsApp privacy changes appeared first on Gizmochina.

TikTok faces $155,000 fine for mishandling child data in South Korea

Sean — Wed, 15 Jul 2020 08:36:08 +0000

TikTok, the popular video sharing platform, has come under fire again. This time in South Korea as regulators are fining social media giant for the mishandling of child data.

The Korea Communications Commission (KCC) has fined the company for 186 million won or roughly 155,000 US Dollars. For those unaware, the KCC acts as the regulator and overwatches the country’s telecommunications and data related sectors. The fine it has imposed on TikTok is due to the company failing to protect users’ private data, especially regarding its younger user demographic.

Notably, the fine is equivalent to 3 percent of the company’s annual sales within the country, which is the amount designated for such violations under local privacy laws. KCC began the investigation into this matter back in October 2019 and found that TikTok collected that data of children under the age of 14 without consent from their legal guardians.

According to KCC, a minimum of 6,0007 pieces of child data were collected between 31st May 2017 and 6th December 2019. Furthermore, TikTok had also failed in notifying its users of the transfer of personal data overseas. The investigation also revealed that the company uses four cloud service providing companies, namely Alibaba Cloud, Fastly, Edgecast, and Firebase.

The news arrives just a few weeks after recent negative events for the company. India, where one of its highest userbases resides, has banned the app over security concern, similar to the US Army back in January. The company also recently announced that it would be exiting the Hong Kong market, due to China’s new security laws.

(Via)

The post TikTok faces $155,000 fine for mishandling child data in South Korea appeared first on Gizmochina.

HMD Global releases statement regarding Nokia 7 Plus alleged “data breach”

Habeeb Onawole — Sat, 23 Mar 2019 06:49:37 +0000

A few days ago, there were reports that HMD Global was sending user data to China. The affected model is the Nokia 7 Plus and the issue was reported to affect several units of the phone sold in Norway. Yesterday, HMD Global released an official statement to clear the air on the matter.

According to the Finnish company which manufactures its phones in China via FIH Mobile, the Foxconn subsidiary, the Nokia 7 Plus didn’t share personal data with any third party. What the phones did send to a third party server in China is actually device activation data. However, this shouldn’t have happened in the first place.

Apparently, a certain batch of Nokia 7 Plus meant for countries outside China had the device activation client for China mistakenly installed on them, instead of that of the right country variant. HMD Global says the issue was fixed in February and almost all owners of the Nokia 7 Plus from the affected batch have installed the fix.

Below is an infographic that explains the data collected from users :

Nokia 7 Plus devices that already have the fix installed have build number “00WW_3_39B_SP03” or “00WW_3_22C_SP05”. You can check the build number by going to Settings > System > About Phone > and then scroll down to “Build Number”.

HMD Global says only devices sold in China have their data stored in China while the user activation data and user experience data (for those who opt-in for the latter) of the global variants are stored on their (HMD Global) servers in Singapore which is provided by Amazon Web Services.

The manufacturer also debunked the rumor that other Nokia phones are sharing user data with third-party servers. “We can confirm that this is incorrect speculation and no Nokia phones are impacted.”. HMD Global also used the opportunity to reassure users that it takes their privacy and security seriously and complies with applicable privacy laws.

(Source)

The post HMD Global releases statement regarding Nokia 7 Plus alleged “data breach” appeared first on Gizmochina.

Weather App from TCL reportedly collects too much user data

Jeet — Fri, 04 Jan 2019 05:41:16 +0000

A free weather information application from TCL named ‘Weather Forecast—World Weather Accurate Radar’ has been collecting unusual amounts of information from its users, claims security experts.

According to the reports, the application has been collecting personal data including email addresses and mobile identification numbers and the data are then transmitted to servers based in China. Further, it is claimed that the app has also subscribed users to paid services without permission.

This is very crucial given that the app has been downloaded over 10 million times on Google Play Store. According to a London-based security firm Upstream Systems, TCL‘s ‘Weather Forecast’ asks to collect information including users’ geographic locations, email addresses, and International Mobile Equipment Identity (IMEI) numbers.

Weather Forecast—World Weather Accurate Radar

It goes on to claim that TCL has also been attempting to fraudulently subscribe users of budget Alcatel smartphones in countries like Brazil, Malaysia, and Nigeria to paid “virtual reality services”. As per the security firm, Brazil alone received around 2.5 million transaction attempts from Alcatel devices in July and August last year.

The security firm says that the attempts were blocked after the company discovered the activity. It further says that while the app is no longer attempting to subscribe users to third-party services, it still continues to collect user data.

In response to these accusations, the company said that it is “evaluating new security consultants who can provide additional validation of the safety of our mobile applications we develop.”

As said, the app is owned by TCL Communication Technology Holdings Ltd. which is based in Shenzhen, China. TCL is the company that manufactures smartphones for BlackBerry and Alcatel and phones from both those companies come pre-installed with the weather application.

It remains to be seen if Google takes any action against the app or the company. Previously, in December, Google had suspended two Chinese apps from its Play store after allegations that they were exploiting user permissions under an ad fraud scheme.

The Internet Society of China’s analysis into data-gathering practices found that 18 of the most popular apps in the country collected what it deemed excessive user information – including text messages, address book data, and recordings. Almost half of those apps appeared to do this without consent from the user.

(Source)

The post Weather App from TCL reportedly collects too much user data appeared first on Gizmochina.

Chinese Apps Harvesting Excesssive User Data, Suggests New Report

Andrew — Tue, 04 Dec 2018 02:54:21 +0000

Big data has become the new oil of big tech companies across the globe as these giant corporations try to better understand the customer. However, recent big controversial incidents of data theft privacy breach with some high-profile companies have also opened the eyes of users. This is more so the case in China where consumers are becoming wary of the loose rules and guidelines that protect their private data. A new study conducted by the China Consumers Association revealed today that many popular Chinese apps collect an alarming amount of personal data.

According to the study, 100 apps were reviewed out of which 91 apps were found to be involved in the practice. The personal data that these applications collected included user location, contact lists and even mobile numbers on the user’s smartphone. Amongst the most notable apps that were reviewed from the Google Play Store and Apple’s App Store included Alipay from Ant Financial Services, popular photo-editing app Meitu, bike-sharing platform Ofo and even messaging apps like QQ and WeChat from Tencent Holdings.

The matter is even more serious for other small-scale apps revealed the study. “The problem [of excessive data harvesting] is especially severe among smaller app providers, which have no privacy clauses or provide unreasonable terms.” said the report.

RELATED: Nine persons docked for selling info about Samsung’s flexible OLED panels to Chinese entity for $13.85 million

The report comes as tech companies are scaling up their efforts to harvest data which will be used for Artificial Intelligence initiatives in 2019. However, the general populace has become quite aware due to high-profile cases that came into public view this year. In early 2018, China’s three big tech giants – Baidu, Alibaba and Tencent were questioned over their data harvesting practices in Mainland.

(via)

The post Chinese Apps Harvesting Excesssive User Data, Suggests New Report appeared first on Gizmochina.