#1 Trusted Cybersecurity News Platform Followed by 4.50+ million
The Hacker News Logo
Get the Free Newsletter
SaaS Security

metadata | Breaking Cybersecurity News | The Hacker News

NSA Admits Secretly Buying Your Internet Browsing Data without Warrants

NSA Admits Secretly Buying Your Internet Browsing Data without Warrants

Jan 29, 2024 Surveillance / Data Privacy
The U.S. National Security Agency (NSA) has admitted to buying internet browsing records from data brokers to identify the websites and apps Americans use that would otherwise require a court order, U.S. Senator Ron Wyden said last week. "The U.S. government should not be funding and legitimizing a shady industry whose flagrant violations of Americans' privacy are not just unethical, but illegal," Wyden  said  in a letter to the Director of National Intelligence (DNI), Avril Haines, in addition to urging the government to take steps to "ensure that U.S. intelligence agencies only purchase data on Americans that has been obtained in a lawful manner." Metadata about users' browsing habits can pose a serious privacy risk, as the information could be used to glean personal details about an individual based on the websites they frequent. This could include websites that offer resources related to mental health, assistance for survivors of sexual assault or do
Governments May Spy on You by Requesting Push Notifications from Apple and Google

Governments May Spy on You by Requesting Push Notifications from Apple and Google

Dec 07, 2023 Privacy / Data Security
Unspecified governments have demanded mobile push notification records from Apple and Google users to pursue people of interest, according to U.S. Senator Ron Wyden. "Push notifications are alerts sent by phone apps to users' smartphones," Wyden  said . "These alerts pass through a digital post office run by the phone operating system provider -- overwhelmingly Apple or Google. Because of that structure, the two companies have visibility into how their customers use apps and could be compelled to provide this information to U.S. or foreign governments." Wyden, in a letter to U.S. Attorney General Merrick Garland, said both Apple and Google confirmed receiving such requests but noted that information about the practice was restricted from public release by the U.S. government, raising questions about the transparency of legal demands they receive from governments. When mobile apps for Android and iOS send push notifications to users' devices, they are ro
SaaS Compliance through the NIST Cybersecurity Framework

SaaS Compliance through the NIST Cybersecurity Framework

Feb 20, 2024Cybersecurity Framework / SaaS Security
The US National Institute of Standards and Technology (NIST) cybersecurity framework is one of the world's most important guidelines for securing networks. It can be applied to any number of applications, including SaaS.  One of the challenges facing those tasked with securing SaaS applications is the different settings found in each application. It makes it difficult to develop a configuration policy that will apply to an HR app that manages employees, a marketing app that manages content, and an R&D app that manages software versions, all while aligning with NIST compliance standards.  However, there are several settings that can be applied to nearly every app in the SaaS stack. In this article, we'll explore some universal configurations, explain why they are important, and guide you in setting them in a way that improves your SaaS apps' security posture.  Start with Admins Role-based access control (RBAC) is a key to NIST adherence and should be applied to every SaaS a
Signal Secure Messaging App Now Encrypts Sender's Identity As Well

Signal Secure Messaging App Now Encrypts Sender's Identity As Well

Oct 30, 2018
Signal, the popular end-to-end encrypted messaging app, is planning to roll out a new feature that aims to hide the sender's identity from potential attackers trying to intercept the communication. Although messages send via secure messaging services, like Signal , WhatsApp , and Telegram , are fully end-to-end encrypted as they transmit across their servers, each message leaves behind some of the metadata information that reveals who sent the message to whom and when. The new feature, dubbed " Sealed Sender ," announced by Signal is going to further reduce the amount of information that is accessible to the company itself. However, you should note that Signal never stores metadata or logs of information on its users like who sends messages to each other and when, but the new feature would protect the sender's identity in case the communication is somehow intercepted. How Does the Signal's Sealed Sender Feature Protect Metadata? According to a blog post
cyber security

Are You Vulnerable to Third-Party Breaches Through Interconnected SaaS Apps?

websiteWing SecuritySaaS Security / Risk Management
Protect against cascading risks by identifying and mitigating app2app and third-party SaaS vulnerabilities.
Snowden says It's a 'Dark Day for Russia' after Putin Signs Anti-Terror Law

Snowden says It's a 'Dark Day for Russia' after Putin Signs Anti-Terror Law

Jul 09, 2016
Whistleblower and ex-NSA employee Edward Snowden has criticized a new anti-terror law introduced on Thursday by Russian President Vladimir Putin, referring it as "repressive" and noting that it is a " dark day for Russia ." The new legislation signed by Putin would compel the country's telephone carriers and Internet providers to record and store the private communications of each and every one of their customers for six months – and turn them over to the government if requested. The data collected on customers would include phone calls, text messages, photographs, and Internet activities that would be stored for six months, and "metadata" would be stored up to 3 years. Moreover, Instant messaging services that make use of encryption, including WhatsApp, Telegram, and Viber, could face heavy fines of thousands of pounds if these services continue to operate in Russia without handing over their encryption keys to the government. "Putin
Ricochet — Most Secure Peer-to-Peer Encrypted Messenger that Sends No Metadata

Ricochet — Most Secure Peer-to-Peer Encrypted Messenger that Sends No Metadata

Feb 23, 2016
There are several encrypted messaging apps for mobile and desktop platforms that shipped with "The Most Secure" tagline but ends up in de-anonymizing the real identity of its users in some or the other way. In fact, very few encrypted messaging apps available today deal with the core problem of Metadata .  The majority of apps offer end-to-end encryption that kept the content of your messages away from prying eyes, but your metadata will still be accessible to them, which is enough to know who you really are, and who you're talking to. But, one messenger app stands out of the crowd by providing superb anonymity to its users, and it is dubbed as " Ricochet ." Ricochet is a peer-to-peer instant messaging system available for Windows, Mac, and Linux and you can trust it as the app has already cleared its first professional security audit carried out by cyber security company NCC Group . What's so Promising about Ricochet? Unlike
Every Call You Make or Text You Send, They'll Be Tracking From Today

Every Call You Make or Text You Send, They'll Be Tracking From Today

Oct 13, 2015
From today, every phone call you make, every text message you send and every email you write will compulsorily be tracked by the government agencies under a new metadata retention scheme. Yes, you heard right. If you are a citizen of Australia with a mobile phone and an Internet connection, your digital activity will be recorded. As the government's new data retention law comes into effect, the Australian telecommunications companies will now keep large amounts of your telecommunications metadata for two years. The law has allegedly been implemented to protect the country against organized terrorist and criminals, like every government agencies including the United States' intelligence agency NSA and British intelligence agency GCHQ claim. But… This new scheme vastly expands the retention of personal data, which has triggered a debate among Australians as it is a major invasion of privacy . WHAT IS BEING COLLECTED? Until today, data retention by
NSA to Destroy Bulk Collection of Surveillance Data

NSA to Destroy Bulk Collection of Surveillance Data

Jul 28, 2015
The National Security Agency will restrict access to, and ultimately destroy, millions of US phone records previously collected by the spy agency, the Office of the Director of National Intelligence (ODNI) announced Monday. The federal law was passed in June ending the NSA's bulk collection of U.S. Citizen's Telephone records and destroying the data it collected under a controversial global spying program disclosed by former NSA contractor Edward Snowden. So far, the ODNI didn't specify when the agency would destroy these metadata records , but noted that the metadata must be retained until the lawsuits around the metadata collection program are ongoing. NSA's Bulk Metadata Collection is illegal Section 215 of the Patriot Act legally authorizes the law enforcement agencies to collect "any tangible things" that the government proves are connected or linked to an investigation into any suspected terrorist. However, the verdict in May ruled that the mas
ICREACH — NSA's Secret Google-Like Search Engine for Metadata Analysis

ICREACH — NSA's Secret Google-Like Search Engine for Metadata Analysis

Aug 26, 2014
The United States National Security Agency ( NSA ) is using a massive information sharing platform that allows multiple law enforcement agencies to infiltrate more than 850 billion communications records detailing e-mails, phone calls, instant messages, and phone geolocation, according to the classified documents disclosed by former intelligence contractor Edward Snowden. The NSA has built ICREACH, a Google-like search engine that secretly provides data — metadata of both foreigners and citizens on US soil — to nearly two dozen U.S. government agencies, including the DEA, FBI, and CIA, The Intercept reported . Many of those surveilled data had not been accused of any illegal activity as well. But until now, it is unclear that exact what mechanism was used by the US intelligence agency to share the massive amounts of surveillance data, as well as number of government agencies it was sharing information with. Although, the classified documents show that the FBI and the D
Infosec A-Team to Launch NSA-Proof Invisible Messenger for Whistleblowers

Infosec A-Team to Launch NSA-Proof Invisible Messenger for Whistleblowers

Jul 05, 2014
If a whistleblower discloses an activity to the public, then there should be a trust-based mechanism that ensure the protection of truth-tellers on an international level by hiding their identities. In an effort to provide this kind of service and security, Security experts grouped together to create a stealthy Internet Messenger (IM) and file transfer client, which is especially designed for whistleblowers. Dubbed as " ‪invisible.im " is an anonymous Instant Messenger (IM) that leaves no trace‬. The team behind the project called itself " The Infosec A-Team " which includes Metasploit Founder HD Moore , noted infosec and opsec experts The Grugq , an Australian security analyst Patrick Gray , and Richo . Invisible.im aims to serve the rigid anonymity needs of whistleblowers. The project website states: invisible.im was established to develop an instant messenger and file transfer tool that leaves virtually no evidence of conversations or transfers having occurred. Th
Ex-NSA Director Admits 'We Kill People Based On Metadata' with Drone Strike

Ex-NSA Director Admits 'We Kill People Based On Metadata' with Drone Strike

May 14, 2014
We All now know about the existence of the extensive metadata collection program by U.S National Security Agency ( NSA ), which creates an intimate repository of our lives -- whom we love, whom we're friends with, where we work, whom we call, when we you, how long we talk over the calls, and how often calls between the two parties are made and even the your interactions on social networking sites. Although U.S Government always argues that Metadata doesn't record the actual content ( of your call ) and it is used for NSA's automated analysis, but should we be worried? You are unique in the world and therefore your metadata too. So anyone with knowledge of the subject knows that analyzing terabytes of metadata can easily reveal far more details about a person's life than ever before. Worldwide debate on mass surveillance still was not finished yet, but today is a new alarming report revealed that US government murdering people around the world based solely on the
French intelligence agency gets complete access to Orange Telecom Data

French intelligence agency gets complete access to Orange Telecom Data

Mar 21, 2014
Another leak from  Edward Snowden files, but this time not about the NSA, rather the documents revealed that France's central intelligence agency, the DGSE has complete and unconditional  access to all of  telecom giant  Orange's data, not just metadata . Yes! It is the same  Orange company who threatened to sue the NSA for hacking into the underwater cable that it jointly owns with 15 other companies. According to the French paper Le Monde -- Orange, the leading telecom company in France with more than 26 million customers worldwide cooperated allegedly illegally for years with France's main intelligence agency. DGSE and Agents with military clearance have been working with Orange for at least 30 years. France has a PRISM like surveillance  program to target phone communications, emails and data from tech companies like Google, Facebook, Apple, Microsoft and Yahoo. Furthermore, DGSE is also sharing this data with foreign allies like GCHQ.  The revelations c
Federal judge blocks NSA surveillance records from being destroyed

Federal judge blocks NSA surveillance records from being destroyed

Mar 11, 2014
Last week, The Foreign Intelligence Surveillance Court (FISA) ruled the National Security Agency (NSA) to do not keep Internet and phone metadata gathered through bulk surveillance programs longer than five years and destroy them. Judge Reggie Walton said, keeping records for more than 5 years " would further infringe on the privacy interests of United States persons whose telephone records were acquired in vast numbers and retained by the government ," Later, The Electronic Frontier Foundation, an Internet privacy and civil liberties group asked the Court to temporarily hold the destroy orders, saying the records may be used as an evidence in its lawsuits challenging the NSA surveillance . U.S. District Judge Jeffrey White, who is overseeing an invasion-of-privacy lawsuit against the National Security Agency (NSA), ruled to stop the destruction of millions of Telephone records collected by the National Security Agency's surveillance program and ruled to safeguard th
Angry Birds and other Mobile Gaming apps leaking your private information to NSA

Angry Birds and other Mobile Gaming apps leaking your private information to NSA

Jan 28, 2014
Are you fond of playing games on your Smartphone like Angry Birds or Subway Surfer ?? You should now stop wasting your time, because NSA is utilizing your gaming energy in the best possible way. According to the latest documents leaked by former U.S. Government contractor Edward Snowden , Some of the world's most popular Smartphone applications are telling British (GCHQ) and American intelligence agencies ( NSA ) everything about you. NSA is tapping communication across the Internet of all " leaky " apps ( Unencrypted app, without SSL connection ) to peek into the tremendous amounts of very personal data, including your age, location, sex and even sexual preferences. This is really unacceptable! The Guardian claims that the NSA and its UK counterpart GCHQ have been developing capabilities to take advantage of these 'leaky' apps, collecting most sensitive information such as sexual orientation and " even sends specific sexual preferences such a
NSA admits to collect 200 Million text messages per day under Project DISHFIRE

NSA admits to collect 200 Million text messages per day under Project DISHFIRE

Jan 17, 2014
After the exposure of various surveillance programs, including PRISM, XKeyscore, MUSCULAR, DROPOUTJEEP in recent revelation, NSA has come up as the only ' Government that Actually Listen '. Another day and here comes another revelation - According to the The Guardian , National Security Agency (NSA) has collected almost 200 million text messages per day from across the globe and is using them to extract data including location, contact networks and even credit card details. The two names that come in the limelight are,  DISHFIRE  that collects " pretty much everything it can "and PREFER  that conducted automated analysis of the untargeted communications. The program was designed to collect the text messages automatically from various service providers, to pull the details of financial transactions, roaming charges, delayed flights, missed calls and scheduled alerts, address book contacts, credit cards, bank accounts and visited locations. Now If I am not wrong the word ' Untarge
Judge Ruled - NSA Telephone Metadata Collection violates the Fourth Amendment

Judge Ruled - NSA Telephone Metadata Collection violates the Fourth Amendment

Dec 17, 2013
Big and Good news for all of us. A federal court judge ' Richard J. Leon ' said that he believes, US National Security Agency's (NSA) controversial practice of routinely collecting the telephone records of millions of Americans likely violates the 4th Amendment and is unconstitutional, even though the FISA court approved it. Earlier in 2013, a conservative Legal Activist Larry Klayman filed a lawsuit against the US government, alleging that NSA's massive telephone surveillance program violates the " reasonable expectation of privacy, free speech and association, right to be free of unreasonable searches and seizures and due process rights. " NYTimes reported that last Monday in the decision, Judge has ordered [  Case:  Klayman v. Obama (13-851)  PDF File  ] the NSA to stop collecting U.S. Citizen's Telephone records, and to destroy the files it already holds. This was the first major court ruling about NSA' so-called metadata counter terrorism program after
Security Risks of FTP and Benefits of Managed File Transfer

Security Risks of FTP and Benefits of Managed File Transfer

Dec 10, 2013
File transfer services such as FTP or HTTP has been the most common way of file transfer for business requirements. Typically what a file transfer means is that a file transfer protocol such as FTP or HTTP is used to send the stream of bits stored as a single unit in a file system including file name, file size, timestamp and other metadata from one host to another host over a TCP-based network such as the Internet. But this process is not foolproof. FTP, by itself, is not a secure file transfer protocol and it has a lot of security vulnerabilities. It's a known fact that FTP doesn't provide any encryption for data transfer. Most of the times, the requirement in any business is pretty simple: to transfer files between two endpoints in different locations, and the parties involved do not think much about how secure the file transfer process is going to be. Using FTP for official file transfer can leave your data transmission exposed to many security attacks: FTP Bounce Attack Gener
'Dark Mail Alliance', Future of surveillance proof email technology

'Dark Mail Alliance', Future of surveillance proof email technology

Oct 31, 2013
Yesterday I learned about  ' Dark Mail Alliance ', where  Lavabit , reportedly an email provider for NSA leaker Edward Snowden and Silent Circle comes together to create a surveillance-proof email technology. Ladar Levison at Lavabit and Silent Circle CEO Mike Janke, Founders of two e-mail services that recently shut down amid government efforts to nab encryption keys, as well as the larger revelations regarding the NSA's surveillance efforts. The newly developed technology has been designed to look just like ordinary email, with an interface that includes all the usual folders i.e. inbox, sent mail, and drafts. But where it differs is that it applies peer-to-peer encryption not only to the body of the digital missive, but also to its metadata (To:, From: and Subject fields) that third parties are most likely to collect. The encryption, based on a Silent Circle instant messaging protocol called SCIMP and the secret keys generated to encrypt the communic
Cybersecurity Resources