Four EPICS Base flaws found by an autonomous system could let attackers crash processes at particle accelerators and fusion labs.
The post Long-Hidden Flaws Patched in EPICS Research Facility Control Software appeared first on SecurityWeek.
Phishing is an attack in which someone impersonates a person or organization you trust, like your host, registrar, bank, or colleague, in order to steal information, redirect a payment, or talk you into an action that helps them. The message is the delivery vehicle, and the goal is always the next action you take.
If you run a website, you’re on both sides of this problem. Your hosting panel, domain registrar, WordPress admin, email, and payment accounts are all valuable targets, and if an attacker gets in through any of them, your site can quietly end up hosting phishing pages aimed at someone else’s customers.
Continue reading What Is Phishing? Recognizing and Preventing Attacks at Sucuri Blog.
Quest Diagnostics has confirmed that an unauthorized party accessed a system healthcare providers use to order laboratory tests and view results, affecting personal information and patient records.
Quest is a major US laboratory testing company whose services help healthcare professionals diagnose and monitor medical conditions. Those services range from routine laboratory testing to specialized testing in areas such as cancer, infectious diseases, and neurology.
The company learned of unauthorized access to its Quanum Lab Services Manager, or LSM, on October 21. The compromised platform lets healthcare professionals order tests, access results, review historical trends, and order supplies. Quest paused access to the platform and began investigating. Quest says its core business operations remain up and running.
An investigation is ongoing. Quest has not yet published a count of affected patients or a complete list of the information accessed. It says it will notify affected patients, healthcare providers, and health plans.
The company said:
“personal information and patient records were affected.”
It confirms that health information and personally identifiable information were involved, but has not specified whether these included Social Security numbers, insurance identifiers, payment information, particular test results, or account passwords.
Quest says it will send notification letters to affected patients once its investigation is complete. Those letters will describe available resources, including credit and identity monitoring. If you receive one, read it carefully and follow the instructions. You can also check the FAQs posted in Quest’s breach notice for updates.
A breach does not automatically mean someone has misused your information, but you can take these precautions while you wait for more details:
Medical identity theft is not just a financial problem; it can also affect your care. Someone using your identity to obtain treatment or submit insurance claims could introduce incorrect information into your health records. Checking medical statements and reporting anything unfamiliar can help you catch that misuse.
Let’s face it, an incognito window can only do so much.
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.
Quest Diagnostics has confirmed that an unauthorized party accessed a system healthcare providers use to order laboratory tests and view results, affecting personal information and patient records.
Quest is a major US laboratory testing company whose services help healthcare professionals diagnose and monitor medical conditions. Those services range from routine laboratory testing to specialized testing in areas such as cancer, infectious diseases, and neurology.
The company learned of unauthorized access to its Quanum Lab Services Manager, or LSM, on October 21. The compromised platform lets healthcare professionals order tests, access results, review historical trends, and order supplies. Quest paused access to the platform and began investigating. Quest says its core business operations remain up and running.
An investigation is ongoing. Quest has not yet published a count of affected patients or a complete list of the information accessed. It says it will notify affected patients, healthcare providers, and health plans.
The company said:
“personal information and patient records were affected.”
It confirms that health information and personally identifiable information were involved, but has not specified whether these included Social Security numbers, insurance identifiers, payment information, particular test results, or account passwords.
Quest says it will send notification letters to affected patients once its investigation is complete. Those letters will describe available resources, including credit and identity monitoring. If you receive one, read it carefully and follow the instructions. You can also check the FAQs posted in Quest’s breach notice for updates.
A breach does not automatically mean someone has misused your information, but you can take these precautions while you wait for more details:
Medical identity theft is not just a financial problem; it can also affect your care. Someone using your identity to obtain treatment or submit insurance claims could introduce incorrect information into your health records. Checking medical statements and reporting anything unfamiliar can help you catch that misuse.
Let’s face it, an incognito window can only do so much.
Breaches, dark web trading, credit fraud. Malwarebytes Identity Theft Protection monitors for all of it, alerts you fast, and comes with identity theft insurance.
EFF legal intern Gabrielle Ladun was the principal author of this post.
The Department of Homeland Security Office of Inspector General (DHS OIG) has published a summary of findings from its audit of the Transportation Security Administration’s (TSA) facial recognition technology. While the detailed findings are classified, the summary states that the OIG’s audit uncovered a “significant weakness” in the technology’s ability to protect the privacy of passenger data. This has massive privacy implications for the millions of passengers who travel and don’t opt out of the TSA’s biometric surveillance technology verification process.
TSA uses facial comparison technology for identity verification of airline passengers. A camera takes a photo of passengers to verify that their provided identification matches their live photo. Although TSA states that it is “committed to protecting traveler privacy,” the audit highlights that this has not been the case.
The OIG found that TSA’s Credential Authentication Technology 2’s (CAT-2) vendor “was able to access and extract sensitive passenger information, including driver’s license and passport images, during system troubleshooting and enhancements, without TSA’s knowledge.”
The OIG further admonished the agency:
TSA lacked clear policies, did not track when this data was extracted, could not verify that extracted information was properly deleted, and did not notify passengers when their biometric and biographic information may have been stored. As a result, although passenger information was generally protected during routine operations, weaknesses in vendor oversight created a risk that sensitive personal information could be retained or exposed.
We hope the TSA will fix these issues. The OIG summary states:
We issued one finding and three recommendations to strengthen controls, improve oversight, and ensure transparency and the proper handling of passenger data. TSA concurred with all three recommendations. Two recommendations are open and resolved, and one remains open and unresolved.
EFF has a long history of opposing governmental use of facial recognition technology. As the OIG’s audit underscores, this technology presents privacy risks associated with unsecured data, unauthorized access, and data breaches. The government’s use of this technology also creates a mass surveillance system and facilitates the creation of warrantless biometric records for unconsenting parties.
The biometric data captured by this technology is not without errors. There have been multiple instances of law enforcement agencies using facial recognition technology to misidentify and arrest innocent individuals.
Given that facial recognition technology is prone to mistakes, combined with the OIG’s audit revealing significant privacy weaknesses, it is imperative that travelers remember that opting out is possible. TSA’s own website emphasizes that travelers who wish to decline to have their photo taken for facial comparison can do so without any delay, disruption, or recourse.
Considering the data protection weaknesses exposed by the OIG’s audit, EFF will continue to oppose this governmental system of mass surveillance and spread awareness to ensure that no one is forced to relinquish their biometric data without consent.
Login