Short Topix: Epik Data Breach Impacts Millions, Customer & Non-Customers Alike

by Paul Arnote (parnote)

The Assault On Your Privacy: Monthly Update

AN EXPOSÉ BY PROPUBLICA details how Facebook has undermined "privacy protections" for its 2 billion WhatsApp users. Despite assuring users that no one can see their posts, Facebook runs an extensive monitoring operation, and even regularly shares personal information with prosecutors. It's odd typing "Facebook" and "privacy" in the same sentence, as the two are as antithetical as any two words could possibly be. This just illustrates that point perfectly.

PROTONMAIL HAS REMOVED "WE DO NOT KEEP ANY IP LOGS" FROM ITS PRIVACY POLICY, according to an article on ArsTechnica. Based in Switzerland, the privacy-focused email provider was forced by Swiss courts to log and disclose a French climate activist's IP address and browser fingerprint to Swiss authorities. Being a Swiss-based company, ProtonMail was forced to comply with a Swiss court injunction ordering it to log the IP address and browser fingerprint of the particular ProtonMail account. Since then, ProtonMail has changed its privacy statement to users, removing "By default, we do not keep any IP logs that can be linked to your anonymous email account". The replacement privacy statement is a bit muddier, and makes no mention of logging IP addresses.

In more Facebook news, a lawsuit (PDF) by shareholders filed back in August 2021 and just made public against Facebook and Facebook upper management discloses that FACEBOOK PAID $4.9 BILLION MORE TO SETTLE A FEDERAL TRADE COMMISSION LAWSUIT FOR THE CAMBRIDGE-ANALYTICA SCANDAL than it had to. And why, you might ask? All to "protect" CEO and founder Mark Zuckerberg from being named as a defendant, or to keep him from even having to give a deposition in the case, according to an article on The Guardian.

According to a blog entry from the internet security company called Expel, they HAVE IDENTIFIED THE TOP PHISHING KEYWORDS FROM THE LAST 10,000 MALICIOUS EMAILS THEY HAVE INVESTIGATED. Emails with the following words were associated with phishing attempts: Invoice, Message, Required, Request, and Action, among others. Believe it or not, even emails where the subject line was left blank made the list. If you're concerned about phishing attempts (defined by Merriam-Webster's online dictionary as a scam by which an Internet user is duped (as by a deceptive email message) into revealing personal or confidential information which the scammer can use illicitly), you might want to head on over to the blog entry to see the full article.

Get Ready: Windows 11 "Debuts" October 5

Just in time for Halloween, the scary ... er, new ... Windows 11 makes its public debut on October 5, according to a Microsoft Windows blog. The new version of Windows will be available free to Windows 10 users with eligible PCs. Also, new computers preloaded with Windows 11 will start to become available then.

Windows 11 sports a new, cleaner desktop look, along with a new Microsoft Store to allow easier access to the programs and apps users want (according to the blog). The rollout of the free Windows 11 upgrade will be done in phases, with the hopes of not repeating the frequent missteps of the Windows 10 updates. Microsoft hopes to offer the free upgrade to all eligible devices by mid-2022.

The blog also stated that Windows 10, whether it's on PCs that aren't eligible for update to Windows 11 or deferred by users who don't wish to upgrade to Windows 11, will be supported until October 14, 2025.

Epik Data Breach Impacts Millions, Customers & Non-Customers Alike

You may not have heard of Epik, an internet domain name registrar and web hosting service. But, you probably have heard of Gab, Parler, 8chan, and even the Republican Party of Texas. These right-of-center conservative websites (and in some instances, far, far right-wing websites) found refuge on Epik from increasing attacks by those perceived to subscribe to a more leftist view of politics.

In the wake of its hack, dubbed Operation EPIK FAIL by Anonymous, they said in a now unreachable press release on the 4chan website that the data includes "domain registrations, domain transfers, passwords, account credentials for all of Epik's customers, logins, more than a half-million private keys, payment history, and more," according to another article from The Daily Dot. "This dataset is all that's needed to trace actual ownership and management of the fascist side of the Internet that has eluded researchers, activists, and, well, just about everybody," continued the press release.

Epik had initially denied the data breach, but then its CEO, Robert Monster, sent an email out to Epik customers the next day warning them of the data breach. Because of the Epik CEO's initial response to queries about the data breach, Anonymous took it upon themselves to "alter" the company's official knowledge base, as well.

An article on ArsTechnica pointed out that Epik had scraped and stored registrar data for websites it did not host, and that data was part of what was included in the data breach. That exposed data for customers and non-customers alike among the over 15 million data records released in the data breach. Another article on TechCrunch revealed that a security researcher reached out to the Epik CEO a few weeks before the data breach to let them know about a security vulnerability, but his message to Monster on LinkedIn went unanswered and unheeded. Gauging by the date stamps on the files involved, the data breach appears to have happened sometime in February 2021.

Update Google Chrome Now: 11 Security Fixes

If you are a Google Chrome browser user and you don't run updates on your PCLinuxOS computer very frequently, you might want to run your updates sooner rather than later. For example, I'm guilty of not running updates more than once a month. I'm more of the mind of "if it ain't broke, don't fix it." See! I wouldn't make a very good developer. They seem to subscribe to the motto "fix it until it breaks."

Google has released Google Chrome version 93.0.4577.82 to address 11 security issues. This update is currently in the PCLinuxOS repository. Google paid $20,000 in bounty money to the security researchers who discovered just the first three of the security issues listed below. The discoverers of the other eight security issues are still awaiting payment of their bounty booty, with those amounts still to be determined, according to a blog that covers Google Chrome browser releases.

Here are the security issues that were discovered. All were given a "high risk" rating.

CVE-2021-30625: Use after free in Selection API
CVE-2021-30626: Out of bounds memory access in ANGLE.
CVE-2021-30627: Type Confusion in Blink layout.
CVE-2021-30628: Stack buffer overflow in ANGLE.
CVE-2021-30629: Use after free in Permissions.
CVE-2021-30630: Inappropriate implementation in Blink.
CVE-2021-30631: Type Confusion in Blink layout.
CVE-2021-30632: Out of bounds write in V8.
CVE-2021-30633: Use after free in Indexed DB API.

Google has acknowledged that exploits already exist "out in the wild" for the last two security issues listed above.

If you want to know more about each security issue, just use your favorite internet search engine to search for the CVE number listed above (e.g., CVE-2021-XxXxX). In doing so myself, I discovered that some of these security issues aren't just for Google Chrome. Some of these security issues affect all of the browsers that use the Chromium code base, such as Chromium, Opera, Edge, Vivaldi, and (of course) Google Chrome.

Different Rules For Me & Thee

Whether you use Facebook or not, you probably know someone who has spent time in what is euphemistically known as "Facebook Jail." I'm not a Facebook user (never have, never will), but I know a few people who are routinely in "Facebook Jail." That is where the user's account is suspended for a period of time for breaking Facebook "rules."

Well, according to an article from Gizmodo, those "rules" can be rather "fluid," depending on if you are an entertainer, politician, or some other kind of "influencer." Despite ad nauseum claims of treating everyone equally, Facebook has run an internal program called "XCheck" for years. This program essentially allows the rich and powerful to play by their own rules, without fearing moderation that the rest of the peon users are subjected to.

It's claimed that the XCheck program was created to help add an extra layer of review for high-profile users. But the net effect is that the XCheck program allows those same high-profile users to circumvent the ordinary moderation process, and helps Facebook avoid unwanted "PR firestorms."

So, essentially, the rich, powerful and influential members of Facebook get preferential treatment, allowed to post content that would result in disciplinary action for "ordinary" users.

Tsk, tsk, tsk! Shame on you, Facebook! Or, should it be shame on Facebook users, for supporting a platform that behaves this way? It's this type of behavior that fans the flames for breaking up companies like Facebook. They certainly don't do themselves any favors with this type of behavior.

PCLinuxOS Magazine Short Topix Roundup

AN ISRAELI ANTIVIRAL HIV DRUG HAS PROVEN TO BE AN EFFECTIVE TREATMENT FOR COVID-19, according to an article on The Jerusalem Post. Code Pharma's Codivir drug is preparing to enter Stage 2 clinical trials. Early use in a small number of COVID-19 patients (12) showed a direct antiviral effect against coronavirus. According to the article, "five of the patients showed a very profound decline in the viral load during the treatment. Codivir significantly suppressed viral replication in all patients with an antiviral effect noted as early as three days after the beginning of treatment." The Stage 2 trials will be expanded to 150 patients in a double blind study, and if the early results hold to be true, Code Pharma plans to ask for emergency use authorization at the end of the Stage 2 trials. The Stage 2 trials are expected to last between three and six months.

ONE TECH COMPANY IS BUCKING THE SILICON VALLEY TREND BY SEEKING OUT OLDER DEVELOPERS, according to an article on TechRepublic. It's no secret that the younger programmers are in high demand in Silicon Valley tech firms, and the age discrimination against older programmers is often open and blatant. The employment ad, posted on RelevantDB.com, reads like any other programmer ad. That is, until you get to the end, where it reads, "Unlike Silicon Valley, we do not discriminate based on age. Experience matters. We hire old people. (And young people, too.)." It concludes by asking for principal applicants, and asking for no recruiters to respond.

ONE HACKER GOT CAUGHT IN A PRETTY EMBARRASSING WAY when he failed to separate his illegal activities from his personal activities. The Ukrainian hacker would use a botnet to brute-force crack 2,000 passwords a week, and then sell those passwords on the dark web, according to an article on TechRadar. Except authorities were able to scan the contents of the Gmail addresses Glib Oleksandr Ivanov-Tolpintsev used to conduct his illegal activity. There, mixed amongst his illegal activity, were his messages and orders to Ukrainian vape shops, complete with his full name and address. The hacker was arrested in Poland, and extradited to the U.S., where he will stand trial.

TIRING OF MICROSOFT'S STONEWALLING BY MAKING IT VERY CUMBERSOME TO SWITCH TO ANY OTHER BROWSER THAN MICROSOFT EDGE, Mozilla has reverse engineered the Microsoft-only process for designating Edge as the default browser in Windows 10, according to an article on The Verge. The end result is that Mozilla Firefox can now be set as the default browser on Windows 10 from within the Firefox browser, as of Firefox 91. All of the "heavy lifting" is done in the background, and without user hassle. Microsoft is ignoring a six-year ongoing plea from Mozilla by making it even more difficult to set a default browser in Windows 11 other than Microsoft Edge.

ROLLING STONE MAGAZINE UPDATED ITS TOP 500 SONGS OF ALL TIME LIST for the first time in 17 years. With something as subjective as music, you can imagine the fallout over this new list. Over half of the songs on the new list weren't on the old 2004 list, including one-third of the top 100. If you're like me, you will be wondering "how did that make it onto a list of the top 500 songs of all time" when you see its appearance on the list. What surprised me most were the songs and artists that didn't make it onto the list. I'm certain that your opinion, while unique to you and your life experiences and taste in music, will be similar to mine.