Category: privacy

Nearly seven years later, CNN launched their own investigation of “Airbnb’s hidden camera problem”.

CNN: “Across North America, police have seized thousands of images from hidden cameras at Airbnb rentals, including people’s most intimate moments… It’s more than just a few reported cases. And Airbnb knows it’s a problem. In this deposition reviewed by CNN, an Airbnb rep said 35,000 customer support tickets about security cameras or recording devices had been documented over a decade. [The deposition estimates “about” 35,000 tickets “within the scope of the security camera and recording devices policy.”]

Airbnb told CNN a single complaint can involve multiple tickets.
CNN actually obtained the audio recording of an Airbnb host in Maine admitting to police that he’d photographed a couple having sex using a camera hidden in a clock — and also photographed other couples. And one Airbnb guest told CNN he’d only learned he’d been recorded “because police called him, months later, after another guest found the camera” — with police discovering cameras in every single room in the house, concealed inside smoke detectors. “Part of the challenge is that the technology has gotten so advanced, with these cameras so small that you can’t even see them,” CNN says.

But even though recording someone without consent is illegal in every state, CNN also found that in this case and others, Airbnb “does not contact law enforcement once hidden cameras are discovered — even if children are involved.” Their reporter argues that Airbnb “not only fails to protect its guests — it works to keep complaints out of the courts and away from the public.”

They spoke to two Florida attorneys who said trying to sue Airbnb if something goes wrong is extremely difficult — since its Terms of Service require users to assume every risk themselves. “The person going to rent the property agrees that if something happens while they’re staying at this accommodation, they’re actually prohibited from suing Airbnb,” says one of the attorneys. “They must go a different route, which is a binding arbitration.” (When CNN asked if this was about controlling publicity, the two lawyers answered “absolutely” and “100%”.) And when claims are settled, CNN adds, “Airbnb has required guests to sign confidentiality agreements — which CNN obtained — that keep some details of legal cases private.”

Responding to the story, Airbnb seemed to acknowledge guests have been secretly recorded by hosts, by calling such occurrences “exceptionally rare… When we do receive an allegation, we take appropriate, swift action, which can include removing hosts and listings that violate the policy.

“Airbnb’s trust and safety policies lead the vacation rental industry…”

“On June 6, 2024, an unknown third party impersonated a company employee to compromise their business credentials and gain access to certain business systems,” the company said in a filing. “We detected the incident within 12 hours and immediately launched an internal investigation to terminate the unauthorized access, remediate affected systems and ascertain if any customer data was impacted.” Ars Technica’s Dan Goodin reports: RansomHub, the name of a relatively new ransomware group, has taken credit for the attack, which it said yielded more than 10GB of customer data. RansomHub emerged earlier this year as a rebranded version of a group known as Knight. According to security firm Check Point, RansomHub became the most prevalent ransomware group following an international operation by law enforcement in May that took down much of the infrastructure used by rival ransomware group Lockbit.

On its dark web site, RansomHub said it was in advanced stages of negotiation with Rite Aid officials when the company suddenly cut off communications. A Rite Aid official didn’t respond to questions sent by email. Rite Aid has also declined to say if the employee account compromised in the breach was protected by multifactor authentication.

To perform such a fingerprinting attack and glean what video or a website a user might be watching or visiting, the attacker conducts a series of latency measurements of the victim’s network connection as the content is being downloaded from the server while they are browsing or viewing. It then involves a post-processing phase that employs a convolutional neural network (CNN) trained with traces from an identical network setup to make the inference with an accuracy of up to 98% for videos and 63% for websites. In other words, due to the network bottleneck on the victim’s side, the adversary can deduce the transmitted amount of data by measuring the packet round trip time (RTT). The RTT traces are unique per video and can be used to classify the video watched by the victim. The attack is so named because the attacking server transmits the file at a snail’s pace in order to monitor the connection latency over an extended period of time.

Geisinger — which says it operates 13 hospitals and has more than 600,000 members — said it discovered the improper access on November 29, informed Nuance, and the IT supplier immediately cut off the former employee from the healthcare group’s data before involving police. “Because it could have impeded their investigation, law enforcement investigators asked Nuance to delay notifying patients of this incident until now,” Geisinger claimed, explaining why only now this is coming to light. “The former Nuance employee has been arrested and is facing federal charges.” It’s not immediately clear if or what charges have been laid — we’ve asked Geisinger for details.

Speech recognition firm Nuance performed its own probe, according to Geisinger, and determined that the former employee may have stolen information on a million-plus people. That info would include birth dates, addresses, hospital admission and discharge records, demographic information, and other medical data. The ex-employee didn’t swipe insurance or other financial information, the multi-billion-dollar healthcare group stated. “We continue to work closely with the authorities on this investigation, and while I am grateful that the perpetrator was caught and is now facing federal charges,” Geisinger chief privacy officer Jonathan Friesen alleged, adding: “I am sorry that this happened.”

While BleepingComputer did not download the archive, the threat actor shared a text file containing a complete list of the 6,223 folders stolen from the company’s GitHub repository. The folder names indicate that a wide variety of information was stolen, including IT documentation, infrastructure tools, and source code, allegedly including the viral Wordle game. A ‘readme’ file in the archive states that the threat actor used an exposed GitHub token to access the company’s repositories and steal the data. The company said that the breach of its GitHub account did not affect its internal corporate systems and had no impact on its operations. The Times said in a statement to BleepingComputer: “The underlying event related to yesterday’s posting occurred in January 2024 when a credential to a cloud-based third-party code platform was inadvertently made available. The issue was quickly identified and we took appropriate measures in response at the time. There is no indication of unauthorized access to Times-owned systems nor impact to our operations related to this event. Our security measures include continuous monitoring for anomalous activity.”

The threat actor also shared data samples, allowing BleepingComputer to confirm with numerous customers listed in the breach that their data was accurate and that they recently requested support or an RMA from Cooler Master. Other data in the samples included product information, employee information, and information regarding emails with vendors. The threat actor claimed to have partial credit card information, but BleepingComputer could not find this data in the data samples. The threat actor now says they will sell the leaked data on hacking forums but has not disclosed the price. Cooler Master said in a statement to BleepingComputer: “We can confirm on May 19, Cooler Master experienced a data breach involving unauthorized access to customer data. We immediately alerted the authorities, who are actively investigating the breach. Additionally, we have engaged top security experts to address the breach and implement new measures to prevent future incidents. These experts have successfully secured our systems and enhanced our overall security protocols. We are in the process of notifying affected customers directly and advising them on next steps. We are committed to providing timely updates and support to our customers throughout this process.”

“The presence of third-party trackers belonging to advertisers, and the oversharing of customer information with these trackers, is a pervasive problem in both health tech and government space,” he explains. “Once shared, advertisers have used this information to target ads at users for complementary products (based on health data); this has happened multiple times in the past few years, including at Goodrx. Although this does not fit the traditional definition of a data breach, it essentially results in the same outcome — an entity and the use case the data was not intended for has access to it. There is usually no monitoring/auditing process to identify and prevent the issue.”

The resulting settlement required Ring to delete content that was found to be unlawfully obtained, establish stronger security protections and pay a hefty fine. The FTC says that it’s now using much of that money to refund eligible Ring customers. According to a Tuesday notice, the FTC is sending 117,044 PayPal payments to impacted consumers who had certain types of Ring devices — including indoor cameras — during the timeframes that the regulators allege unauthorized access took place. Eligible customers will need to redeem these payments within 30 days, according to the FTC — which added that consumers can contact this case’s refund administrator, Rust Consulting, or visit the FTC’s FAQ page on refunds for more information about the process.

The researchers’ latest work builds on a study they published a year ago of 3,747 US non-federal hospital websites. That found 98.6 percent tracked and transferred visitors’ data to large tech and social media companies, advertising firms, and data brokers. To find the trackers on websites, the team checked out each hospitals’ homepage on January 26 using webXray, an open source tool that detects third-party HTTP requests and matches them to the organizations receiving the data. They also recorded the number of third-party cookies per page. One name in particular stood out, in terms of who was receiving website visitors’ information. “In every study we’ve done, in any part of the health system, Google, whose parent company is Alphabet, is on nearly every page, including hospitals,” [Dr Ari Friedman, an assistant professor of emergency medicine at the University of Pennsylvania] observed. “From there, it declines,” he continued. “Meta was on a little over half of hospital webpages, and the Meta Pixel is notable because it seems to be one of the grabbier entities out there in terms of tracking.”

Both Meta and Google’s tracking technologies have been the subject of criminal complaints and lawsuits over the years — as have some healthcare companies that shared data with these and other advertisers. In addition, between 20 and 30 percent of the hospitals share data with Adobe, Friedman noted. “Everybody knows Adobe for PDFs. My understanding is they also have a tracking division within their ad division.” Others include telecom and digital marketing companies like The Trade Desk and Verizon, plus tech giants Oracle, Microsoft, and Amazon, according to Friedman. Then there’s also analytics firms including Hotjar and data brokers such as Acxiom. “And two thirds of hospital websites had some kind of data transfer to a third-party domain that we couldn’t even identify,” he added. Of the 71 hospital website privacy policies that the team found, 69 addressed the types of user information that was collected. The most common were IP addresses (80 percent), web browser name and version (75 percent), pages visited on the website (73 percent), and the website from which the user arrived (73 percent). Only 56 percent of these policies identified the third-party companies receiving user information. In lieu of any federal data privacy law in the U.S., Friedman recommends users protect their personal information via the browser-based tools Ghostery and Privacy Badger, which identify and block transfers to third-party domains.