(Note.. This article was published after the 30 day disclosure period in order to give mi-taxi / Mississauga Taxi a chance to resolve the disclosed issues.) Intro Mississauga Taxi (mi-Taxi) is a taxi company located in Mississauga, Ontario, Canada, who's mobile application uses an unsecured ElasticSearch server. That unsecured server was…
Exposure Alert: During the development of an MQTT auditing tool, I have come across a mis-use/mis-configuration issue with the BizBox Alpha software which is developed and sold by Douzone (Duzon) of South Korean. On Dec 20th 2018, the exposure notice, and details were sent to Douzone in order to…
Based on my first hand experience of discovering approximately 3000 credit card images, and drivers licenses / passports in a data breach, the answer is: Vendor Note Pass / Fail I received a token gesture of "we will look into it, but we don't want any details". 2 weeks later I'm still…
Full Article posted on IT World Canada: Canadian researcher warns of vulnerability in protocol used by M2M applications Howard Solomon Howard Solomon @howarditwc Published: December 5th, 2018 Poor security surrounding an obscure but common machine-to-machine messaging protocol is exposing personal and corporate data, warns a Canadian security researcher. Darryl Burke,…
On Wed Nov 23rd, we discovered a misconfiguration on the web servers of the company "Locksmith Services" which is a US based national dispatch service for Locksmiths. The misconfiguration on the website dispatchlogin.net exposed the; audio recording of calls, emails, customer contact information, photos of drivers licenses…
So..... Dropbox has over the last few months been warning about requiring an Ext4 file system to be able to use the linux (Ubuntu) client.. in effect requiring you to use an unencrypted drive (you better be using one..) to store your dropbox content. Well here is a way to…
It's been 3 months since the initial post about the exposure of customer data by BIOS Medical / Thermor LLC on thier Bluetooth Blood Pressure, and Ear Thermometers. And the #1 rule of writing secure applications is.. NEVER ROLL YOUR OWN CRYPTO.. ` Why won't people learn that... On May 18th and…
Summary: The mobile software, and backend servers created by BIOS Medical / Thermor Ltd used in their Bluetooth enabled Blood Pressure Monitor and Ear Thermometer suffer from serious design flaws which expose the private medical information of their customers Products Affected: Protocol 7D MII Blood Pressure Monitor Model BD245 Precision Temp…
As I'm sure you didn't notice (and most people won't) a new Data "Use" Notice was sent out by Google today with regards to the use of Android Auto and your personal information(and your vehicles). Most of the Data Notice is pretty obvious with the use of…
Lining up the ducks, and getting legal advice before this is published.…