WhatsApp hacked to spy on govt officials in 20 countries, including India

The revelation comes as more than a dozen Indian journalists and human rights activists said on Thursday they were also targeted

Senior government officials in multiple US-allied countries were targeted earlier this year with hacking software that used Facebook-owned instant messaging app WhatsApp to take over users’ phones, according to people familiar with the messaging company’s investigation.

Sources familiar with WhatsApp’s internal investigation into the breach said a “significant” portion of the known victims were high-profile government and military officials spread across at least 20 countries in five continents. The hacking of a wider group of top government officials’ smartphones than previously reported suggests the WhatsApp cyber intrusion could have broad political and diplomatic consequences.

WhatsApp filed a lawsuit on Tuesday against Israeli hacking tool developer NSO Group. The Facebook-owned software giant alleges that NSO Group built and sold a hacking platform that exploited a flaw in WhatsApp-owned servers to help clients hack into the cellphones of at least 1,400 users.

While it is not clear who used the software to hack officials’ phones, NSO says it sells its spyware exclusively to government customers. Some victims are in the US, United Arab Emirates, Bahrain, Mexico, Pakistan and India, said people familiar with the investigation. Reuters could not verify whether victims from these countries included government officials. The revelation comes as more than a dozen Indian journalists and human rights activists said on Thursday they were also targeted....

Google Plus is shutting down after massive data exposure of 500K accounts

The domestic unit on Monday slumped 30 paise to finish at a fresh lifetime low of 74.06 amid strengthening of the greenback and steady capital outflows.

Tech giant Google is shutting down its social networking site Google Plus after a technical glitch was found to have compromised accounts and personal information of over 500,000 of its users.(Technology News)

The announcement in this regard was made by Ben Smith, Google Fellow and vice-president of engineering, in a blog post Monday, in which he noted that the Indian-American headed company could not confirm which users were impacted by the bug.

“However, we ran a detailed analysis over the two weeks prior to patching the bug, and from that analysis, the profiles of up to 500,000 Google+ accounts were potentially affected. Our analysis showed that up to 438 applications may have used this API,” he said.

“We found no evidence that any developer was aware of this bug, or abusing the API, and we found no evidence that any profile data was misused,” Smith said.

The technical bug was detected as part of an effort called Project Strobe started by Google early this year. It is a root-and-branch review of third-party developer access to Google accounts and Android device data and of our philosophy around apps’ data access, he wrote.

————>>> Business Standard OR  BS <<<————

Available online: This website exposes data stored by Indian firms

Indian firms caught napping as private details of individuals were leaked

A new website, created by an anonymous user, has exposed the lack of data security practices in major companies around the world, including some Indian firms. The website, which surfaced on the internet last week, seeks to collect all publicly available data from servers of Amazon Web Services’ storage buckets.

The website lists all publicly available data, which is sometimes harmless such as manuals for products or terms and conditions for web-based applications. However, technology experts in India have found data containing personal information, which can potentially be a big privacy scare. These “buckets” store information on lab test reports of lakhs of people from a Mysore-based health start-up, offer letters provided by food delivery aggregator Swiggy, online ticketing data by Justickets and bank account statements as well as income proofs submitted by people to a digital lender in Mumbai.

It was unearthed by Srikanth L, a software engineer, who found multiple data stores of Indian companies and promptly alerted them to fix the leak. “A Mysore based / #HealthTech company/startup with Mysore clientele exposing Lab reports, prescriptions, a scan of signatures (Yes, doctors yours too!) 1000+ documents,” he wrote on Twitter.

Srikanth said while public storage buckets on Amazon serves an important use case of disseminating publicly accessible information to users in a fast and effective manner, companies should be careful about putting up personally identifiable information/confidential documents there and restrict access if they do choose to upload on third-party servers. For instance, Swiggy has delegated its HR functions to a start-up Hirexp, which seems to have uploaded resumes, offer letters and recordings of interviews on Amazon servers. While the company said there was no leak from its end, Business Standard reviewed these documents and recordings, which were made private by Tuesday evening.(READ FULL ARTICLE)

Facebook violates privacy policy, allows phone makers to access users' data

While the device partnerships allowed Facebook to expand its reach, it let the phone makers offer customers popular features of the social network



Raising fresh concerns about Facebook's privacy protection policies, a New York Times report has exposed how the social network allowed about 60 device makers, including Apple and Samsung, to access personal information of users and their friends.

Even before Facebook apps were widely available on smartphones, Facebook had data-sharing partnerships with the device makers, the report said citing company officials, adding that most of the deals remain in effect.

While the device partnerships allowed Facebook to expand its reach, it let the phone makers offer customers popular features of the social network, such as messaging, "like" buttons and address books.

The deals raise concerns about the company's privacy protections and compliance with a 2011 consent decree with the US Federal Trade Commission (FTC), The Times said.

Facebook, which is already under scrutiny for misuse of millions of its users' data after the Cambridge Analytica data leak scandal became public, reportedly allowed the device companies access to the data of users' friends without their explicit consent.

While Facebook's leaders said that the kind of access exploited by the political consulting firm in 2014 was cut off by the next year as it prohibited developers from collecting information from users' friends.

But the company officials did not disclose that such restrictions were not applicable to makers of cellphones, tablets and other hardware, the report said.

However, Facebook officials denied the device partnerships violated its privacy policies, the FTC agreement and pledges to users.

They said its partnerships were governed by contracts that strictly limited use of the data, including any stored on partners' servers, adding that they knew of no cases where the information had been misused.

"These partnerships work very differently from the way in which app developers use our platform," Ime Archibong, a Facebook vice president was quoted as saying.