Michelle Dvorak

Google and Unacast Glean GPS Location Data from Your Cellphones Helping Governments Enforce Stay-at-Home Orders

Google announced in a blog post that it is tracking people’s movemnets using phone location data to help governments track stay-at-home orders. They are the only one. An public webpage launched by a Norwegian company is tracking and reporting the location of US citizens via their data collected from their own smartphones. Unacast, Inc. based in Norway is using GPS location data from people’s smartphones and displaying it on their Social Distancing Scoreboard. Now state governments are using it to track and enforce their stay-at-home measures. States are scored with a grading system, with an A to F rating, to judge the mobility of their residents. It can also be used to see where people are congregating.

Unacast silently collects data in the background of “free” games, apps, social media sites, weather apps, and others installed on smartphones. The collection and distribution of data is legal (though highly questionable) through seldom read and usually confusing user agreements. Privacy advocates consider this to be “surveillance” technology.” Unacast does not focus on world health as the focus of their day job. According to the company’s website they track people and sell aggregate date to retail, travel, tourism, marketing, and real estate clients. “Our clients use human mobility data to expand their understanding of customers beyond their doors.” states Unacast’s website, the company helps clients “identify areas of opportunity across marketing, real estate and operations.”

As of today, Unacast gave the entire United States a B minus or below with the exception of the District of Columbia.

State agencies like The Kansas Department of Health and Environment are using Unacast’s a Social Distancing Scoreboard to monitoring how citizens are complying with the stay-at-home orders. This prompted the Kansas Justice Institute to inquire about whether there was a contract in place to monitor citizens.

Unacast’s website states, “we’ve been contacted by government officials and health policy experts at the local, state, and federal levels expressing great enthusiasm for our aggregated analysis”

Kansas has a D rating according to Unacast.

RELATED READS

• How to Disable Location Data on Your iPhone
• How to Disable Location Data on Your Android Device
• Google Apps That Track Your Location
• Google Maps Location History – View Your Location History in Google Maps and Shut Off Tracking
• How to Shut Off Google Location Tracking

And some questions about if government agencies or states have access to more precise or frequently updated data are mounting. According to Lawrence Journal-World ,“The publicly available data on Unacast’s website currently has a four-day lag time, the company noted on its website, while Norman said the data he had access to updated every other day. The post refers to Kansas Health Secretary Dr. Lee Norman.

You Are Being Surveilled

You are being surveilled courtesy of your own smartphone. Although the data is supposedly, anonymized and aggregated this is a real concern for data privacy advocates. Firms like Unacast can be sketchy because they’re collecting locations without consent from people. Basically, your cell phone location data is being used to track your movements to monitor whether you are complying with social distancing requirements under the guise of fighting the spread of COVID-19 — requirements that people nationwide are still getting accustomed to.

Locaiton tracking presents privacy issues because the people being surveilled rarely realize that their location and history were being used by companies like Unacast for tracking and reporting.

Google Is Also Tracking and Reporting Your Location

Not to be outdone Google has also created “mobility reports” avaialble for download to assess the movements of citizens. Google aggregates location data from a number of web properties and apps they own – including the obvious Google Maps, but also from other apps like YouTube, Chrome web browser, the Play Store, Google Wallet, Photos that use location data to tag places, and Gmail.
“For these reports, we use differential privacy, which adds artificial noise to our datasets enabling high quality results without identifying any individual person,” Google writes. “The insights are created with aggregated, anonymized sets of data from users who have turned on the Location History setting, which is off by default.”

The reports consist of per country, or per state, downloads (with 131 countries covered initially), further broken down into regions/counties — with Google offering an analysis of how community mobility has changed vs a baseline average before COVID-19 arrived to change everything.

Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers

www.metrony.com/

Online Schools May Inadvertently Put Your Child’s Data and Privacy at Risk – Here’s How to How to Keep Your Child Safe Online

How to keep your child safe in online schools. Many children are now suddenly involved in online classroom settings that are new to students, parents, and educators. Although it is fabulous school districts have been catapulted into embracing online technologies, it has been a mad scramble to take classrooms and assignments online in a secure manner. Data privacy is at risk. Parents may find it challenging to keep up with the flurry of login credentials to video conferencing websites and online leaning platforms. Notifications and emails may be coming from multiple sources, making it confusing to keep track of who is sending what and who has received it. Emails with attachments and links to other websites can be potentially dangerous as they are prime targets for hackers.

In July 2019, three Louisiana public schools were successfully shut down by a ransomware attack. The cyber attack infected ten percent of Louisiana’s 5,000 IT servers and over 1,500 computers. Also in July 2019, Rockville Centre School District was paralyzed by a Ryuk ransomware cyber attack. The district’s insurance carrier paid a ransom of $88k USD to recover the network. In October 2019, a ransomware shut down Las Cruces Public Schools in New Mexico. The district mitigated the attack by reformatting 30,000 devices and refused to pay the ransom.

It’s always better to be safe than sorry.

Online Schools – How to Keep Your Child Safe

Use a Secure WiFi Network

If you’re working in a place where there are multiple WiFi networks to choose from and yours won’t work for some reason – it’s too slow for example, don’t just log in to any network that your phone or compute detects. Hackers can set up WiFi networks that appear to allow you to access the internet while they record what you look at online, your passwords, data, emails, and messages. This puts your online accounts and money at risk. For example, if you’re on a hacker’s network and log into your bank, the hacker can steal that password from your web browser.

Even if a hacker can get a low-level password for a social media account, they can likely use it to hack into a more valuable account like a credit card or bank account. People often use the same password across multiple online accounts. So, if a hacker gets your email address and one password, they may be able to use that information to break into a lot of your other online accounts too.

Always use secure WiFi that is protected with a password of its own and unique passwords. Try saving them in a password manager for extra security.

Be on the Look Out for Phishing Emails

My daughter started online classes today. Emails from teachers are flying as teachers and students scramble to adapt to a new learning environment. Some emails from the new learning platform they are using for online classes. Some emails are coming from the platform they had been using all along to track grades and assignments. Still other emails are coming from school district email accounts. Some emails, like those from the strict, have Word docs attached. Others email have links in the body of the email prompting me to read a message on the learning platform. In the last 24 hours I have received over 15 new emails.

ALL of these email notifications from online schools are ripe for hackers to launch phishing email and malware campaigns targeting parents, teachers, and kids. With emails originating from three different domains (the learning platform, the school district, and the older progress tracker) it can be east to miss a spoofed email address. A hacker can buy a domain name that is closely name to your school district website and send emails containing links to malicious website and weaponized email attachments.

Do you think your school district is too small for a hacker to mess with it? In 2019, the number if cyber attacks on schools tripled and included kindergarten through 12th grade schools , Universities, and local governments. Primary public school districts across the U.S. suffered a total over 500 cyberattacks in 2019. Hackers only need one person with a privileged network account open a weaponized email to get a malware infection started. These cyber attacks can disable a school IT system for weeks (Don’t get any ideas kiddos!!!)

Ask that your school district stop sending emails with attachments (see the part about macros below) and upload all communications to one channel. They should use the platform to distribute Word docs, spreadsheets, pdf files, and other classroom materials as downloads. That way parents and students receive notifications from one source and to to the learning platform for all attachments avoiding harmful links in emails and potentially damaging email attachments.

Ask Your Child’s Teacher to Use a PIN for all Online School Meetings

Recently an online Norwegian class of young school students was interrupted by a nude man who had guessed the URL to the children’s live class. The teacher was using Zoom, a popular video conferencing platform but had not set a PIN code to control who attended. The perv was talking to and exposing himself to the children over the live video class before some parents saw what was happening. It is believed that the man had cycled through random meeting ID links until he got one that worked and joined the video call. This is not the first time this has happened.

Conference call apps like WebEx, Zoom, Uber Conference and others, use a standard link structure for calls that can be joined from a computer web browser. The teacher or meeting organizer can opt to require a passcode to join the call. Higher quality platforms may assign a unique URL to each attendee to add more protection and track attendance. If the meeting organizer has a subscription to the online video call service, the link may always be the same to make it easier for people to remember. That also makes it easier for hackers to remember too! With so many people working and attending school at home now, hackers have a lot better luck just randomly guessing at links that many connect them to calls.

The Norwegian class was not protected with a passcode although it could have been. Ask your child’s teacher to require a PIN code to join any online class or video call.

Disable Macros on Microsoft Files

Enabling macros is dangerous. All Microsoft Office documents including MS Word and Excel files commonly used by students, can contain built-in macros that give them certain functionality. Macros are small chunks of computer code that can handle repetitive tasks. Although they do have legitimate uses, hackers frequently use macros to infect your computer with malware. All of the recent COVID-19 phishing emails and malware attacks use macro enabled MS Word documents sent via email to infect the victim’s computer.

Hackers can embed macros inside documents and spreadsheets that automatically run as soon as you open a file. They spread malwares such as spyware, viruses, and key loggers to infected computers. Although up to date versions of Microsoft Office contain security features that may protect your computer from macros, they are still potentially very dangerous. Use a reputable antivirus app to protect your computer and be sure to disable macros.

Use a Virtual Private Network (VPN)

VPN stands for virtual private network. A VPN is software or app that you can download to all of your computers, phones, and even your WiFi enabled television to keep the information sent from these devices private. When devices are sharing an internet connection, like in a home for example, it is easy for anyone to see the contents of messages, what website you visited, and files sent. Although parents may not want their children to hide what they are doing online, many parents are working from home and need to keep their employer’s information private. A VPN subscription costs only a few dollars per month and can be shared with all devices in the home. We reviewed several VPNs. I use IPVanish VPN and one of your other authors uses PIA VPN for watching Netflix, but the VPNs listed below are all good quality.

What to Do if You Think Your Childs Information May Already Be at Risk

If you think that you received a phishing email or have somehow compromised your computer, then download an antivirus app right away. This will help start the process of cleaning up your phone or computer. Be wary of free antivirus apps or ones that you download from review websites as they can be malware themselves.

After you have cleaned up your computer and phone, and reconnected to the internet using secure WiFi, change ALL of your usernames and passwords. Don’t reuse passwords across multiple online accounts. Download a password manager that will generate hard to guess passwords that are unique for each online account.

How to Keep Online Schools Safe

• Do not set meetings or classrooms public
• Require a passcode or PIN to join any call
• Do not share Zoom conference links on public social media
• Restrict screen-sharing options so only the host can share thier screen during a video call
• Ensure users keep their conferencing apps up to date

Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers

www.metrony.com/

538M Weibo Hacked User Data for Sale on the Dark Web – Includes 172 M Phone Numbers

Weibo usernames and location are for sale on the dark web. According to a post by Jinse.com the hacker selling the data hacked into Weibo in mid-2019 and stole the user database of 538 million users. The cache of data includes real names, Weibo usernames, gender, and geographic location. Hacked data also includes account information also includes Weibo user ID, number of posts, number of followers. For 172 million of those users phone numbers are also exposed. No passwords are for sale. It’s all for sale for a bargain price of ¥1,799 ($250).

Weibo posted a notice about the data, dismissing the incident as voluminous queries against its API. Weibo assures users that their accounts are safe because passwords were not hacked. Weibo users have the ability to query the usernames of friends and phone numbers in their phone’s address book. The company claims this interface was used in a brute force attack to steal the user data. However, the corporate statement does not logically explain how the hacker obtained other details like gender and location data that is not part of API query results.
“Users’ mobile phone numbers were leaked through forced matching with an address book API in 2019. The rest of the public information was scraped on the web.”
Weibo later removed the notice.

Weibo Data Breach User Info for Sale on the Dark Web

What is Weibo?

Sina Weibo, or simply Weibo, is a social media channel with over 600 million users and more than half of the microblogging market. Weibo is the Chinese word for “microblogging” which causes confusion with other Chinese microblogging services with similar names like Tencent Weibo, Sohu Weibo, and NetEase Weibo.

Sina Weibo is second only to WeChat in China in terms of number of users. It can be used in English, but users must have a verified Chinese phone number to get an account.

Sina Weibo, now known as Weibo, initially used the domain name t.sina.com.cn when the app launched but change to weibo.com in 2011. The social media channel is sort of a cross between Facebook and twitter, which are censored content in Mainland China. Apps are available for iPhone/iPad, Android, Windows Phone, Symbian, BlackBerry OS, as well as Weibo Desktop.

Data Privacy is a Concern

Even though account passwords are not part of this data breach, it is still a concern. People often use the same password across multiple online accounts. If the hacker, or whoever buys the stolen data, matches the user phone number to a password from another data breach, it is possible to hack into any account using the same login credentials. For example, if you use the same password for Weibo that you do for your email, the hacker can use that to reset passwords for more valuable accounts like payment cards, eWallets, and bank accounts.

In January the hacked 30 million payment cards were posted for sale on the dark web by Jokers Stash.

How to Create a Strong Password

• Read our Guide on the Most Common Hacked Passwords to know what to avoid
• Create a Strong Password that is hard to guess. Try using a sentence
• Create a unique password for each online account
• Use a Password Manager to help you create original passwords that are hard to crack
• A Password Vault can remember them for you

Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers

www.metrony.com/