1
00:00:05,700 --> 00:00:09,420
Massive location data harvesting
is stealing data using thousands
2
00:00:09,420 --> 00:00:10,770
of popular mobile apps.
3
00:00:11,190 --> 00:00:15,630
Hackers are finding new ways of breaching
Apple's defenses, and Facebook is
4
00:00:15,630 --> 00:00:17,610
caught with a critical vulnerability.
5
00:00:18,640 --> 00:00:20,360
This is Cybersecurity Today.
6
00:00:20,680 --> 00:00:22,170
I'm your host, Jim Love.
7
00:00:23,150 --> 00:00:28,390
A massive breach has exposed how thousands
of popular mobile apps on Android and
8
00:00:28,400 --> 00:00:34,120
iOS were used to track users, precise
locations, without their knowledge.
9
00:00:34,590 --> 00:00:39,490
Files from a firm called Gravy Analytics,
a major location data broker and
10
00:00:39,490 --> 00:00:41,820
its subsidiary, Ventel, were leaked.
11
00:00:42,390 --> 00:00:46,730
revealing that real time bidding
systems are a key weak spot in
12
00:00:46,730 --> 00:00:48,580
the digital advertising world.
13
00:00:48,990 --> 00:00:50,080
Here's how it works.
14
00:00:50,350 --> 00:00:54,810
Companies bid to place ads inside
mobile apps, and during that process,
15
00:00:54,870 --> 00:00:59,380
data brokers can intercept and harvest
user location information without
16
00:00:59,400 --> 00:01:01,780
users or app developers knowing.
17
00:01:03,080 --> 00:01:07,880
The hacked data includes tens of millions
of phone coordinates from users worldwide.
18
00:01:08,320 --> 00:01:12,110
Among the affected apps are social
networks, fitness trackers, and
19
00:01:12,120 --> 00:01:14,680
even religious apps like Muslim Pro.
20
00:01:15,630 --> 00:01:18,590
Privacy experts warn that the
data collected includes sensitive
21
00:01:18,590 --> 00:01:21,990
locations such as health
clinics and places of worship.
22
00:01:22,440 --> 00:01:25,010
Gravy Analytics has reportedly
sold this data to U.
23
00:01:25,010 --> 00:01:25,170
S.
24
00:01:25,170 --> 00:01:29,220
government agencies, including
the FBI, ICE, and the IRS.
25
00:01:30,010 --> 00:01:34,280
This breach raises critical privacy
concerns and exposes a serious
26
00:01:34,280 --> 00:01:38,300
flaw in how digital advertising
systems handle user data.
27
00:01:38,770 --> 00:01:43,130
Zach Edwards, a cybersecurity researcher,
called it a nightmare scenario for
28
00:01:43,130 --> 00:01:47,820
privacy and warned that other data
brokers may be using similar methods.
29
00:01:48,845 --> 00:01:52,305
The Federal Trade Commission has taken
action against similar practices in
30
00:01:52,305 --> 00:01:56,765
the past, but this breach shows that
the problem persists, highlighting
31
00:01:56,765 --> 00:02:01,279
the urgent need for stricter
controls in the ad tech industry.
32
00:02:03,400 --> 00:02:07,940
Hackers are increasingly targeting Apple
devices, signaling the end of Mac's long
33
00:02:07,940 --> 00:02:10,680
standing security by obscurity reputation.
34
00:02:11,020 --> 00:02:14,990
For years, Apple products were
seen as safer than Windows PCs and
35
00:02:14,990 --> 00:02:19,220
Android devices due to their smaller
market share and a closed ecosystem.
36
00:02:19,810 --> 00:02:25,160
But that perception is changing as Apple's
popularity grows, making its ecosystem
37
00:02:25,160 --> 00:02:27,380
a prime target for cyber criminals.
38
00:02:27,660 --> 00:02:31,100
We did stories last week about how
North Korean hackers were going
39
00:02:31,100 --> 00:02:36,150
after the Mac OS, and now, a recent
breakthrough hack of the iPhone
40
00:02:36,150 --> 00:02:42,000
15's custom Ace 3 USB C controller
shows another new attack vector,
41
00:02:42,220 --> 00:02:44,500
this time aimed at the iOS devices.
42
00:02:45,135 --> 00:02:48,835
It turns out that the new USB
C connections are not blindly
43
00:02:48,835 --> 00:02:50,265
transporting data and power.
44
00:02:50,495 --> 00:02:54,735
They're sophisticated systems, and
it turns out, vulnerable to attacks.
45
00:02:55,285 --> 00:02:59,260
At the 38th, uh, Chaos Communications
Congress in Hamburg, Germany.
46
00:02:59,570 --> 00:03:03,510
Security researcher Thomas Roth,
also known as "stacksmashing",
47
00:03:03,770 --> 00:03:08,540
demonstrated how he exploited the
controller to achieve code execution.
48
00:03:09,610 --> 00:03:14,010
The ACE3 controller manages power delivery
and internal communication in Apple
49
00:03:14,010 --> 00:03:19,710
devices, and Roth used techniques like
reverse engineering and electromagnetic
50
00:03:19,710 --> 00:03:22,190
fault injection to unlock the firmware.
51
00:03:22,755 --> 00:03:26,305
And while Apple's hardware remains
more secure than many alternatives,
52
00:03:26,625 --> 00:03:31,225
Roth's hack shows that even custom
components can be vulnerable.
53
00:03:31,655 --> 00:03:34,935
He warned that his discovery could
pave the way for future attacks,
54
00:03:34,935 --> 00:03:39,265
with bad actors potentially finding
more exploits in Apple's ecosystem.
55
00:03:40,295 --> 00:03:44,815
Roth reported his findings to Apple,
but the company's response was cautious.
56
00:03:44,865 --> 00:03:49,705
In a similar case involving the ACE2
controller, Apple initially pledged to
57
00:03:49,705 --> 00:03:54,545
fix the issue, but later decided it was
a hardware problem they wouldn't address.
58
00:03:55,275 --> 00:03:58,475
As Apple's presence in personal
and enterprise computing grows,
59
00:03:58,665 --> 00:04:02,035
security experts say the company
will need to prioritize more
60
00:04:02,035 --> 00:04:03,915
proactive security measures.
61
00:04:06,355 --> 00:04:09,955
And finally, a security researcher
recently discovered a critical
62
00:04:09,965 --> 00:04:14,545
vulnerability in Meta's Facebook
ad platform, raising alarms about
63
00:04:14,545 --> 00:04:16,605
security of online ad systems.
64
00:04:17,285 --> 00:04:21,505
Ben Sagdehipour found that a server
used for creating and delivering
65
00:04:21,515 --> 00:04:26,215
Facebook ads was vulnerable to a
previously patched Chrome browser flaw.
66
00:04:26,725 --> 00:04:27,555
Here's what happened.
67
00:04:28,045 --> 00:04:31,865
Facebook's infrastructure still
relied on a headless version of
68
00:04:31,865 --> 00:04:33,915
Chrome that hadn't been updated.
69
00:04:34,225 --> 00:04:38,685
By exploiting this flaw, Sagdehipur
was able to run commands on an
70
00:04:38,685 --> 00:04:41,865
internal server, effectively
giving him control of it.
71
00:04:42,745 --> 00:04:46,445
The flaw known as remote code
execution could have been used
72
00:04:46,455 --> 00:04:50,715
to access sensitive data or other
servers within Facebook's network.
73
00:04:51,385 --> 00:04:55,092
After reporting the issue to Meta
in October, 2024, the company
74
00:04:55,092 --> 00:04:59,442
fixed it within an hour and
awarded him a 100, 000 bug bounty.
75
00:04:59,942 --> 00:05:03,862
Sagdehipur said the vulnerability
highlights a broader risk, however,
76
00:05:04,112 --> 00:05:08,462
in online ad platforms, which
process vast amounts of user data
77
00:05:08,712 --> 00:05:10,752
through server side operations.
78
00:05:11,112 --> 00:05:15,012
He warned that other companies might
be at risk if they're using similar
79
00:05:15,012 --> 00:05:17,512
technologies without proper patching.
80
00:05:18,492 --> 00:05:21,752
He said, there's so much that
happens in the background of making
81
00:05:21,752 --> 00:05:25,602
these ads, whether video, text,
or images, and these processes
82
00:05:25,632 --> 00:05:27,712
open the door to vulnerabilities.
83
00:05:28,752 --> 00:05:33,522
The takeaway ad tech companies need
to ensure their systems are up to
84
00:05:33,522 --> 00:05:38,412
date to prevent cyber criminals
from exploiting server-side flaws.
85
00:05:39,192 --> 00:05:40,512
And that's our show for today.
86
00:05:40,752 --> 00:05:44,922
You can reach me with tips, comments,
and even some constructive criticism
87
00:05:45,102 --> 00:05:49,152
at editorial@technewsday.ca.
88
00:05:49,962 --> 00:05:51,072
I'm your host, Jim Love.
89
00:05:51,582 --> 00:05:52,452
Thanks for listening.
00:00:05,700 --> 00:00:09,420
Massive location data harvesting
is stealing data using thousands
2
00:00:09,420 --> 00:00:10,770
of popular mobile apps.
3
00:00:11,190 --> 00:00:15,630
Hackers are finding new ways of breaching
Apple's defenses, and Facebook is
4
00:00:15,630 --> 00:00:17,610
caught with a critical vulnerability.
5
00:00:18,640 --> 00:00:20,360
This is Cybersecurity Today.
6
00:00:20,680 --> 00:00:22,170
I'm your host, Jim Love.
7
00:00:23,150 --> 00:00:28,390
A massive breach has exposed how thousands
of popular mobile apps on Android and
8
00:00:28,400 --> 00:00:34,120
iOS were used to track users, precise
locations, without their knowledge.
9
00:00:34,590 --> 00:00:39,490
Files from a firm called Gravy Analytics,
a major location data broker and
10
00:00:39,490 --> 00:00:41,820
its subsidiary, Ventel, were leaked.
11
00:00:42,390 --> 00:00:46,730
revealing that real time bidding
systems are a key weak spot in
12
00:00:46,730 --> 00:00:48,580
the digital advertising world.
13
00:00:48,990 --> 00:00:50,080
Here's how it works.
14
00:00:50,350 --> 00:00:54,810
Companies bid to place ads inside
mobile apps, and during that process,
15
00:00:54,870 --> 00:00:59,380
data brokers can intercept and harvest
user location information without
16
00:00:59,400 --> 00:01:01,780
users or app developers knowing.
17
00:01:03,080 --> 00:01:07,880
The hacked data includes tens of millions
of phone coordinates from users worldwide.
18
00:01:08,320 --> 00:01:12,110
Among the affected apps are social
networks, fitness trackers, and
19
00:01:12,120 --> 00:01:14,680
even religious apps like Muslim Pro.
20
00:01:15,630 --> 00:01:18,590
Privacy experts warn that the
data collected includes sensitive
21
00:01:18,590 --> 00:01:21,990
locations such as health
clinics and places of worship.
22
00:01:22,440 --> 00:01:25,010
Gravy Analytics has reportedly
sold this data to U.
23
00:01:25,010 --> 00:01:25,170
S.
24
00:01:25,170 --> 00:01:29,220
government agencies, including
the FBI, ICE, and the IRS.
25
00:01:30,010 --> 00:01:34,280
This breach raises critical privacy
concerns and exposes a serious
26
00:01:34,280 --> 00:01:38,300
flaw in how digital advertising
systems handle user data.
27
00:01:38,770 --> 00:01:43,130
Zach Edwards, a cybersecurity researcher,
called it a nightmare scenario for
28
00:01:43,130 --> 00:01:47,820
privacy and warned that other data
brokers may be using similar methods.
29
00:01:48,845 --> 00:01:52,305
The Federal Trade Commission has taken
action against similar practices in
30
00:01:52,305 --> 00:01:56,765
the past, but this breach shows that
the problem persists, highlighting
31
00:01:56,765 --> 00:02:01,279
the urgent need for stricter
controls in the ad tech industry.
32
00:02:03,400 --> 00:02:07,940
Hackers are increasingly targeting Apple
devices, signaling the end of Mac's long
33
00:02:07,940 --> 00:02:10,680
standing security by obscurity reputation.
34
00:02:11,020 --> 00:02:14,990
For years, Apple products were
seen as safer than Windows PCs and
35
00:02:14,990 --> 00:02:19,220
Android devices due to their smaller
market share and a closed ecosystem.
36
00:02:19,810 --> 00:02:25,160
But that perception is changing as Apple's
popularity grows, making its ecosystem
37
00:02:25,160 --> 00:02:27,380
a prime target for cyber criminals.
38
00:02:27,660 --> 00:02:31,100
We did stories last week about how
North Korean hackers were going
39
00:02:31,100 --> 00:02:36,150
after the Mac OS, and now, a recent
breakthrough hack of the iPhone
40
00:02:36,150 --> 00:02:42,000
15's custom Ace 3 USB C controller
shows another new attack vector,
41
00:02:42,220 --> 00:02:44,500
this time aimed at the iOS devices.
42
00:02:45,135 --> 00:02:48,835
It turns out that the new USB
C connections are not blindly
43
00:02:48,835 --> 00:02:50,265
transporting data and power.
44
00:02:50,495 --> 00:02:54,735
They're sophisticated systems, and
it turns out, vulnerable to attacks.
45
00:02:55,285 --> 00:02:59,260
At the 38th, uh, Chaos Communications
Congress in Hamburg, Germany.
46
00:02:59,570 --> 00:03:03,510
Security researcher Thomas Roth,
also known as "stacksmashing",
47
00:03:03,770 --> 00:03:08,540
demonstrated how he exploited the
controller to achieve code execution.
48
00:03:09,610 --> 00:03:14,010
The ACE3 controller manages power delivery
and internal communication in Apple
49
00:03:14,010 --> 00:03:19,710
devices, and Roth used techniques like
reverse engineering and electromagnetic
50
00:03:19,710 --> 00:03:22,190
fault injection to unlock the firmware.
51
00:03:22,755 --> 00:03:26,305
And while Apple's hardware remains
more secure than many alternatives,
52
00:03:26,625 --> 00:03:31,225
Roth's hack shows that even custom
components can be vulnerable.
53
00:03:31,655 --> 00:03:34,935
He warned that his discovery could
pave the way for future attacks,
54
00:03:34,935 --> 00:03:39,265
with bad actors potentially finding
more exploits in Apple's ecosystem.
55
00:03:40,295 --> 00:03:44,815
Roth reported his findings to Apple,
but the company's response was cautious.
56
00:03:44,865 --> 00:03:49,705
In a similar case involving the ACE2
controller, Apple initially pledged to
57
00:03:49,705 --> 00:03:54,545
fix the issue, but later decided it was
a hardware problem they wouldn't address.
58
00:03:55,275 --> 00:03:58,475
As Apple's presence in personal
and enterprise computing grows,
59
00:03:58,665 --> 00:04:02,035
security experts say the company
will need to prioritize more
60
00:04:02,035 --> 00:04:03,915
proactive security measures.
61
00:04:06,355 --> 00:04:09,955
And finally, a security researcher
recently discovered a critical
62
00:04:09,965 --> 00:04:14,545
vulnerability in Meta's Facebook
ad platform, raising alarms about
63
00:04:14,545 --> 00:04:16,605
security of online ad systems.
64
00:04:17,285 --> 00:04:21,505
Ben Sagdehipour found that a server
used for creating and delivering
65
00:04:21,515 --> 00:04:26,215
Facebook ads was vulnerable to a
previously patched Chrome browser flaw.
66
00:04:26,725 --> 00:04:27,555
Here's what happened.
67
00:04:28,045 --> 00:04:31,865
Facebook's infrastructure still
relied on a headless version of
68
00:04:31,865 --> 00:04:33,915
Chrome that hadn't been updated.
69
00:04:34,225 --> 00:04:38,685
By exploiting this flaw, Sagdehipur
was able to run commands on an
70
00:04:38,685 --> 00:04:41,865
internal server, effectively
giving him control of it.
71
00:04:42,745 --> 00:04:46,445
The flaw known as remote code
execution could have been used
72
00:04:46,455 --> 00:04:50,715
to access sensitive data or other
servers within Facebook's network.
73
00:04:51,385 --> 00:04:55,092
After reporting the issue to Meta
in October, 2024, the company
74
00:04:55,092 --> 00:04:59,442
fixed it within an hour and
awarded him a 100, 000 bug bounty.
75
00:04:59,942 --> 00:05:03,862
Sagdehipur said the vulnerability
highlights a broader risk, however,
76
00:05:04,112 --> 00:05:08,462
in online ad platforms, which
process vast amounts of user data
77
00:05:08,712 --> 00:05:10,752
through server side operations.
78
00:05:11,112 --> 00:05:15,012
He warned that other companies might
be at risk if they're using similar
79
00:05:15,012 --> 00:05:17,512
technologies without proper patching.
80
00:05:18,492 --> 00:05:21,752
He said, there's so much that
happens in the background of making
81
00:05:21,752 --> 00:05:25,602
these ads, whether video, text,
or images, and these processes
82
00:05:25,632 --> 00:05:27,712
open the door to vulnerabilities.
83
00:05:28,752 --> 00:05:33,522
The takeaway ad tech companies need
to ensure their systems are up to
84
00:05:33,522 --> 00:05:38,412
date to prevent cyber criminals
from exploiting server-side flaws.
85
00:05:39,192 --> 00:05:40,512
And that's our show for today.
86
00:05:40,752 --> 00:05:44,922
You can reach me with tips, comments,
and even some constructive criticism
87
00:05:45,102 --> 00:05:49,152
at editorial@technewsday.ca.
88
00:05:49,962 --> 00:05:51,072
I'm your host, Jim Love.
89
00:05:51,582 --> 00:05:52,452
Thanks for listening.
