Seattle-based smart home device maker Wyze says an error by a developer exposed a database to the internet over a three-week period earlier this month. The data included customer emails, nicknames of online cameras, WiFi SSIDs, device information and Alexa tokens.
It can be hard to evade the sight of wall-mounted cameras--but other smart cities technologies are almost undetectable.
The various nodes where sensors and other tech could detect your movements through the city.
LED glasses might not trick biometric cameras—but they will definitely attract the attention of folks on the street.
For example: A site called Internet Noise
searches for randomized phrases and opens five fresh tabs every ten
seconds. (I left it running as I wrote this, and now my browser history
includes pictures of badgers, an online mattress store, an NPR article
about the Supreme Court, and a research paper about gene mutation in
hamsters.) As a cloaking technique, it’s not a perfect veil, writes Emily Dreyfess in Wired:
“It’s actually too random. It doesn’t linger on sites very long, nor
does it revisit them. In other words, it doesn’t really look human, and
smart-enough tracking algorithms likely know that.” The site is more of a
protest over Congress rolling back a not-yet-implemented FCC regulation that would have stymied ISPs from selling users’ browsing history.
Still, Tien advocates a certain degree of self-protection.
He views these measures as a kind of digital hygiene—the “equivalent of
washing your hands when you go to the bathroom,” or getting a flu shot.
But he stresses that they’re only a partial prophylactic: “Nothing that
will make you immune from the problem.”
Other techniques include employing Tor—a network that tries to anonymize the source and destination of your web searches by routing traffic along a convoluted path—and Signal, which offers encrypted messaging and phone calls. The Electronic Frontier Foundation’s Surveillance Self-Defense toolkit also suggests particular tools and behaviors for specific scenarios. People participating in protests, the guide suggests,
might consider stripping meta-data from photos, to make it harder to
match them with identities and locations. But this isn’t a perfect
solution, either, Tien says, because you can only control what you post.
“If I take a picture and scrub the metadata, that’s one thing,” Tien
says. “If my friend takes a picture of me, I can’t do anything about
that.” The Intercept produced a video illustrating step-by-step instructions for phone security at a protest, from adding an access passcode to turning on encryption settings.
On a daily basis, Tien tells me, “I don’t think you or I can
exercise much meaningful self-help against the kind of tracking we’ll
be seeing in real-world physical space.” That’s fodder for a point he
makes about a fundamental asymmetry in the information that’s available
to the bodies that install the cameras and those who are surveilled by
them. There are relatively few laws relating to the expectation of
privacy in a public space. The officials and organizations that install
sensors, cameras, and ever-more-sensitive devices, he says, “have much
more money than you do, much more technology than you do, and they don’t
have to tell you what they’re doing.”
Ultimately, Tien and Gidari both take a long view, arguing
that the most payoff will come from pushing for more transparency about
just what this technology is up to. Part and parcel of that, Tien says,
is resisting the idea that data is inherently neutral. The whole messy,
jumbled mass of it contains information that could have tangible
consequences on people’s lives. Tien says citizens need to remind their
elected officials what’s at stake with data—and in the process, maybe
“dampen their enthusiasm” for the collection of it.
He points out that sanctuary cities could be a prime example.
There, he says, some advocates of immigrant rights are realizing that
data collected via municipal surveillance “might not be such a good
thing when we’re interested in protecting immigrants and the federal
government is interested in deporting them.”
The practical strategies for opting out—of becoming
invisible to some of these modes of surveillance—are imperfect, to say
the least. That’s not to say that data collection is inherently
nefarious, Gidari says—as he wrote in a blog post for the CIS,
“no one wants to live in a ‘dumb’ city.” But he says that opting out
shouldn’t need to be the default: “I don’t think you should have been
opted in in the first place.”
One of the highest-profile hacks of consumer-banking data has sent financial institutions scrambling to figure out how millions of records at one of the biggest proponents of cloud-computing were exposed.
Capital One FinancialCorp. , the fifth-largest U.S. credit-card issuer, said Monday that information of roughly 106 million card customers and applicants was exposed in one of the largest data breaches of a big bank.
The data was stored on Amazon.comInc.’s cloud, according to a federal criminal complaint and people familiar with the matter. The avenue of entry, the companies and investigators said, was a poorly configured firewall—a mechanism designed to wall off privately operated digital systems—that a hacker breached.
Both companies say controls around the data, rather than use of the cloud, were the problem. Still, the data was stored in the cloud, raising questions about whether Capital One put insufficient safeguards in place to lock down customer records when it adopted cloud technology. And the accused hacker’s tenure as a former employee of Amazon’s cloud business highlights the risk—previously little appreciated—of an insider threat.
Cloud computing has boomed as companies have increasingly turned to providers such as Amazon and MicrosoftCorp. to do the work of configuring computers inside their own data centers. The processing power of those servers and storage devices is then rented out to cloud customers, who pay depending on how much work the computers do.
Capital One was an early adopter of cloud-computing among financial institutions as many other banks hesitated to move customer data out of their data centers. But the global cloud business has expanded—including among banks—as companies such as
ADVERTISEMENT
JPMorgan Chase & Co. and Bank of AmericaCorp. became converts. That has heightened the stakes from the Capital One breach for the broader financial-services and cloud-computing industries.
One of the highest-profile hacks of consumer-banking data has sent
financial institutions scrambling to figure out how millions of records
at one of the biggest proponents of cloud-computing were exposed.
Capital One Financial Corp., the fifth-largest U.S. credit-card issuer,
said Monday that information of roughly 106 million card customers and
applicants was exposed in one of the largest data breaches of a big
bank.
The...
By 2023, banks globally are forecast to spend more than $53 billion on public cloud infrastructure and data services, up from $24.3 billion this year, according to market research firm International Data Corp.
The disclosure of the breach has caused a behind-the-scenes scramble at several financial institutions to understand what happened at Capital One, according to a person familiar with the discussions.
“Everyone who is migrating to the cloud is really going to look at their controls,” said Sameer Malhotra, the chief executive of TrueFort Inc., a company that provides cloud security services. However, he added, “I don’t think it’s going to change their intention to move to the cloud.”
Capital One started working with Amazon Web Services in 2014 and has since become a marquee customer.PHOTO: SALVADOR RODRIGUEZ/REUTERS
Although court documents indicate a Capital One error led to the breach, the alleged hacker, Paige A. Thompson, is a former employee at Amazon’s web services unit, the world’s biggest cloud-computing business. That raises questions about whether she used knowledge acquired while working at the cloud-computing giant to commit her alleged crime, said Chris Vickery director of cyber-risk research at the security firm UpGuard Inc. A lawyer representing Ms. Thompson didn’t return messages seeking comment.
ADVERTISEMENT
An Amazon spokesman attributed the hack to a firewall issue, not a cloud-computing problem.
Cloud computing caught on in part because it allowed software engineers to sidestep cumbersome security restrictions and sluggish development processes that made companies’ in-house technologies clunky. But the ease and speed of opting instead to fire up a server through Amazon Web Services has led to many cloud misconfiguration problemsthat can leave sensitive data exposed to unauthorized access.
“It’s easy to misconfigure things and it’s easy to have catastrophic results from those misconfigurations,” Mr. Vickery said.
As the list of companies that have inadvertently exposed data on the cloud has grown, Amazon has taken steps to minimize that risk. In 2017, the company introduced a series of technologies to detect such configuration problems and make them easier to fix.
ADVERTISEMENT
Capital One started working with AWS in 2014 and has since become a marquee customer. In 2015, Capital One Chief Information Officer Rob Alexander said “the financial services industry attracts some of the worst cybercriminals. So we worked closely with the Amazon team to develop a security model, which we believe enables us to operate more securely in the public cloud than we can even in our own data centers.”
“This type of vulnerability is not specific to the cloud,” Capital One said of the hack. “The elements of infrastructure involved are common to both cloud and on-premises data center environments.” The bank added that its use of the cloud helped it respond to the breach faster. The company learned of the incident on July 19 and notified affected customers 10 days later.
Over the years, Capital One has developed systems to prevent data from being inadvertently released to the wider internet, according to a person familiar with the company’s operations.
“Any company that has or is looking to move into the cloud must ensure that their security strategy is developed alongside of that transformation,” said Vincent Liu, a partner with the security-consulting firm Bishop Fox.
ADVERTISEMENT
Mr. Liu, whose company assesses security vulnerabilities on corporate networks, says that while configuration problems happen in corporate data centers as well, he often finds that “basic cyber hygiene gets thrown out the window” as companies move to new technologies such as the cloud.
The financial stakes for companies to safeguard customer information are quickly rising. Credit-reporting companyEquifaxInc. struck a $700 million settlement this month with state and federal authorities concerning its 2017 data breach that exposed information on some 150 million Americans. In Britain,Marriott InternationalInc. faces a potential £99.2 million ($102.5 million) fine over a data breach. The same U.K. regulator this month also proposed a record £183.4 million fine following a hack at British Airways last year.
Capital One said it expected to spend up to $150 million to cover breach-related costs, largely for issues such as notifying customers and paying for credit monitoring. The bank didn’t discuss potential fines.