EU merges giant biometrics database. What could possibly go wrong?

Brexit starts to sound sane?

The 28 countries of the European Union each has its own biometrics databases of citizen IDs, residents, immigration, etc. The Common Identity Repository (CIR) project wants to centralize all that, with one enormous JOIN command.

I know what you’re thinking: “What a great idea! When CIR is up and running, law enforcement will be able to do a much better job of keeping EU citizens safe from all those bad people. I mean, I’m not a bad person, so CIR is a great thing, right?”

But what of the unintended consequences? And what about false positives? And how do we know the data won’t be misused—or hacked? In this week’s Security Blogwatch, we go off grid.


Read more: techbeacon.com/security/eu-merges-giant-biometrics-database-what-could-possibly-go-wrong

Popular ‘WiFi Finder’ App Leaks 2 Million+ Passwords

PSK APK FAIL

A widely used Android app for finding free Wi-Fi passwords was horribly insecure. It’s been sitting on an unsecured database, open to the internet.

And the developer is nowhere to be found. Who knew that this modern version of warchalking could be so dangerous?

It gives a whole new meaning to Pre-Shared Key. In today’s SB Blogwatch, we put a tinfoil hat on your AP.


Read more: securityboulevard.com/2019/04/popular-wifi-finder-app-leaks-2-million-passwords

With No Permission, Facebook Slurped up ‘Hundreds of Millions’ of Email Contacts

Book Another Facebook Farce

This story only gets worse for Facebook: Two weeks ago, I told you about how Zuckerberg’s firm was demanding some users enter their email passwords. But now, further revelations make the situation look much, much worse.

It appears Facebook was actually copying those users’ entire contact lists—without permission. The company says it was “unintentional.” So that’s alright then.

How many more straws can fit on this camel’s back? In today’s SB Blogwatch, we’ve lost count of all the Facebook scandals.


Read more: securityboulevard.com/2019/04/with-no-permission-facebook-slurped-up-hundreds-of-millions-of-email-contacts

Wipro customers hacked, says Krebs. Nothing to see here, says Wipro.

Wipro PR go slow—oh no

IT outsourcing outfit Wipro is under fire this week. Sources say it got hacked months ago, and since then has been used as a jumping-off point to hack its customers. Possibly by a state actor.

If that weren’t bad enough, when Brian Krebs—the journalist who reported the hack—asked the Bengaluru firm about it, his questions were ignored. When Wipro PR finally made a buzzword-bingo statement, it was only sent to Indian media.

And then Wipro executives contradicted the statement. Said execs went on to publicly badmouth the reporter.

This is a terrible example of how to act on a breach report. In this week’s Security Blogwatch, we break out the popcorn.


Read more: techbeacon.com/security/wipro-customers-hacked-says-krebs-nothing-see-here-says-wipro

Microsoft Cloud Breach: Hackers Read Your Email for 90 Days

Face Meets Palm

Hackers have been able to read the email of Microsoft’s free cloud customers—no password required. Yes, you read that right.

Incredibly, the perps got away with it for almost three months, from early January to late March. It appears they stole a master “golden” support credential—presumably via social engineering.

But Microsoft “takes data protection very seriously.” So that’s OK then.

On the face of it, this is palm-worthy to the max. In today’s SB Blogwatch, we can’t believe what we read:


Read more: securityboulevard.com/2019/04/microsoft-cloud-breach-hackers-read-your-email-for-90-days