Security This Week: Employers Are Paying Data Firms to Predict Your Health Risks
The big news this week is that Apple and the FBI
are going to war after a magistrate
ordered Apple to help the FBI hack an iPhone used by a shooter in the San Bernardino attack, and Apple is publicly
fighting the order. Also this week: The president’s NSA advisory board finally got itself
a respected technical expert
who actually understands how surveillance tech works. We explained why
the US considers both a power plant and motion picture studio like Sony
to be a part of its critical infrastructure, which is something hackers
are increasingly targeting.
Instagram added two-factor authentication to its app. And hackers
held an LA hospital’s computers hostage with ransomware.
But that’s not all. Each Saturday we round up the news stories that
we didn’t break or cover in depth at WIRED, but which deserve your
attention nonetheless. As always, click on the headlines to read the
full story in each link posted. And stay safe out there!
Well this sounds a little creepy. Employee wellness firms and
insurers are working with companies to mine sensitive health data about
workers like you: such as which prescription drugs you use, whether you
vote, how you shop—all in order to predict your health needs and risks.
For example, if one of these firms thought you were at risk for
diabetes, it might send you personalized messages about seeing a doctor
or signing up for a weight-loss program. If that isn’t unsettling enough
for you, one wellness firm can predict impending pregnancies by looking
at when a woman fills—or stops filling—her birth control prescriptions,
her age, and the age of any children she already has. Although
employers don’t get access to which individuals are flagged by data
mining, they do receive aggregated data on the number of workers at risk
for each condition.
Security researchers Lawrence Abrams and Kevin Beaumont discovered
ransomware that installs itself after the user opens a Word document
they are emailed, and enables macros (if they’re not already on). The
malicious script encrypts victims’ files and asks for half of a bitcoin
as payment for the key. The malware, called Locky, has infected hundreds
of computers in the US, Europe, Russia, Mali, and Pakistan. Updated
anti-virus software will protect against the malware.
Researchers from Tel Aviv University and Technion have apparently
found a way to gain access to private encryption keys from air-gapped
computers while their equipment is in the other room. It’s not
cheap—about $3000—and is unwieldy, but extracts secret decryption keys
by measuring electromagnetic emanations. Similar research has been
carried out before, but not on PCs using elliptic curve cryptography.
The developers of GnuPG, the implementation of OpenPGP that this
side-channel attack targeted, have released countermeasures to resist
this method.
Google CEO Sundar Pichai has picked a side in the ongoing brawl
between the FBI and Apple over whether the government can compel the
company to build and sign spyware used to unlock its own devices. He’s
siding with Apple. Pichai tweeted that “forcing companies to enable
hacking could compromise users’ privacy,” and that requiring companies
to enable hacking of customer data and devices “could be a troubling
precedent.”
Data intelligence company Distillery matched about 16,000 Iowa
caucus-goers’ mobile device IDs–those unique identifiers accessed by
apps to identify a mobile device, often to determine whether an ad has
been served to a specific user– with their online profiles. It did this
by getting information from people’s phones via ad networks, when users
grant apps or devices access to their location data, and associated
those IDs. Although the data doesn’t personally identify individual
users, it allowed Distillery to surmise that people who loved to grill
or do lawn work in Iowa were far more likely to have voted for Trump,
for example.
Concerned Parents Association, a nonprofit community organization,
has won a case against the California Department of Education. A federal
district court granted it access to millions of public school students’
personal information and school records, including names, social
security numbers, addresses, mental health and medical information,
behavior and discipline record, progress reports, and more. The
nonprofit says it needs all of this data to determine whether California
schools are violating laws including the Individuals with Disabilities
Education Act. Luckily, parents can opt out before April 1 by
visiting a website and
filling out a form (pdf).
Twitter fixed a password recovery bug that had the potential of
exposing nearly 10,000 Twitter accounts’ email addresses and phone
numbers. The microblogging platform recommended following good security
hygiene, such as creating a strong password, using Twitter’s login
verification tool, and revoking access privileges of third party
applications you don’t recognize. It also says it will permanently
suspend any user who exploited the bug to access another account.
In an unexpected case, surveillance drones are being used to protect
worker’s rights. The International Brotherhood of Electrical Workers
union local in Philadelphia is using three camera-equipped drones to
document rule violations at construction sites, and to fly over protests
in order to prove that union members aren’t violating rules.
Comments
Post a Comment