Somebody needs to make a “Dell Dude meme” about this.
“Dude, you’re getting your stuff identity stolen!”
What fuckin data is dell even getting and how?
I got their notice email, apparently I bought a laptop charger from them years ago, and after all this time they were still keeping my name, email and physical address, which now leaked. So that’s how.
That’s insane to me
I’m so glad we banned tik tok so my data doesn’t fall in the wrong hands.
I know you’re being flippant, but it’s worth noting that there is a considerable difference between a company getting hacked like this and an app with unfettered access to the cluster to sensors that we’ve got in our pockets.
Yeah, hackers having my data is so much better than China…
The thing with tik tok isn’t only with the data China can gather from US residents. It’s also how they can use that information to influence the populace and send them propaganda, for example influencing the election results.
Ok, what information could they gather and how would they use that to influence an election?
The section Methods on the Cambridge Analytica wiki page explains it pretty well. While it’s not proven to be able to directly influence voting, it’s effective at swaying people’s opinions and emotions about subjects.
So it’s all bullshit then, got it.
The ban is a dumb policy, but you’re daft if you think the security implications are at all similar.
TikTok was caught injecting a keylogger into their in-app browser and their response was “Well yeah, but we promise we’re not using it.”
doesent literraly every website with autocomplete search queries do this?
No. This is analogous to cross-frame scripting.
So imagine you go to
tiktok.comand you click on a link tobestbuy.com/cool-product-i-want-to-buy. But instead of taking you directly tobestbuy.com/cool-product-i-want-to-buy, it keeps you ontiktok.comand just opens an iframe with a keylogger injected into it.So then when you enter credit card info into the
bestbuy.comUI, thetiktok.comJS can see what you typed.(This scenario is largely impossible these days, due to modern browser security.)
The difference is that if you witnessed this kind of XFS in your desktop browser, you might notice it because the location bar still says
tiktok.com, because you never actually left the site. But in a mobile in-app browser, you don’t need an iframe. You can inject JS directly into the browser itself, making it invisible to the user. As far as you can tell, you’re on regular ol’bestbuy.com, not a modified version of it.bruh
lmao, you asked.
I’m not a security expert, but my tech career has involved a lot of automated testing in weird scenarios, including iframe-based Facebook games and browser-based mobile apps. Automated tests face a lot of the same challenges that a malicious third-party would, so I know a little bit about how to get past them – or rather, how to deliberately create vulnerabilities (in the dev build of your system) so that your tests can get past them.
Edit: I am curious why someone downvoted me on that one though. I can understand how my comment about the ban being dumb but TikTok also shipping a keylogger could anger people on one side or the other. But just explaining how in-app browsers revive a security problem that’s been long-solved in standalone browsers?
These companies should be forced to pay big money to each and every person affected by these breaches. Not like $120. Like $10,000 per. Teach them real lessons
Even $120 would be amazing. I just got an email that said too bad. I just bought a monitor cause that’s where they sold it. Idk why they have to save my info. I just want to pay for the product. If it was up to me, they would delete all my info immediately. They only need to record when the serial number was sold anyway.
Oh if only I was European.
But instead they will be fined, and they will pay that fine to the government.
and then, us as the consumer will pay for the fine as well
They just pay up and do it again. It’s a business expense, not a punishment.
I expect they get themselves insured for it
The breach here is pretty minor, in my book. Name, address, specifics of computer purchased. The name and address is pretty much available and linked already. The computer isn’t, but doesn’t seem that abusable. Maybe it could help someone locate more-expensive, newer computers for theft, but I don’t see a whole lot of potential room for abuse.
Now my friends know I bought an Alienware device. I’m never going to live this down.
It’s only minor if the data points in this breach are used by themselves.
Once you aggregate this with other data breaches, you could end up with a much bigger capability to target anyone in this breach.afaict only if a specific hardware vulnerability was found and they cross-linked it with an online account or other network info to try and exploit it.
Or, I guess you could just assume Windows and go with one of the many zero-days that happen there. The trick is still crosslinking them tho. Presumably google has the wifi info.
Don’t care, punish them all the same.
Instantly makes ransomware far more profitable.
Edit: And heavily discourages self-reporting. There’s a Schneier quote I like: “You can’t defend. You can’t prevent. The only thing you can do is detect and respond.”
If the data is breached, won’t we find out anyways once they start selling it?
Absolutely. But the penalty does modify the cost-benefit analysis. If a hacker demands $5m or else they will release stolen data, you might be more inclined to YOLO the 5 mil on the 1% chance they’re an honest hacker if the penalty for the breach is $50bn.
I agree. Even at $120 each. 120 times tens of millions is serious fucking cash. We need to have a couple of big companies go bankrupt over this shit. Then maybe they will start taking it seriously. Perhaps at that point maintaining personal data on people will be seen as a liability rather than an asset. And that’s what we really need.
In the case of this breach, I’d be happy with a $10 payout, the consequences for me are actually pretty low here. That being said, I think we’d be lucky if Dell had to pay more than $0.50 per person, and that money will probably go to a lawyer’s fees, not me.
Expect a ton of Indian people calling pretending to be Dell Support.
Got this:
Hello, Dell Technologies takes the privacy and confidentiality of your information seriously. We are currently investigating an incident involving a Dell portal, which contains a database with limited types of customer information related to purchases from Dell. We believe there is not a significant risk to our customers given the type of information involved.
What data was accessed? At this time, our investigation indicates limited types of customer information was accessed, including:
- Name
- Physical address
- Dell hardware and order information, including service tag, item description, date of order and related warranty information
So people know how expensive a computer is at the address. What could go wrong
Right, because international hackers are going to mobilize boots on the ground across the world to steal your fucking Optiplex.
I think it’s more likely that an attacker would make a fake collections call if you bought something really expensive, especially if they can prove you bought on credit or something. A little ChatGPT and you’d have a targeted script to use.
The leak didn’t include phone numbers or emails but I’m sure there will be attempts at spear phishing businesses since they can figure out the business name from the physical address.
Dude, you’re getting a delinquency letter.
But, like, we paid our fine. Sorry 🤙
Holy fuck. Is that like all their customers?
