Android apps sharing data with Facebook without users consent

A cyberattack disrupting production of several major U.S. newspapers over the weekend. The target in these attacks was Tribune Publishing, the parent behind papers including the Chicago Tribune, the Baltimore Sun, and the New York Daily News. The company was able to find a workaround and paper delivery is planned to be back to normal today. But what to make of this? What are the greater implications? Joining me now, security analyst with Hotspot Spot Shield, Robert Siciliano. Robert, good to see you. What do you make of this attack, and does it look like something that we've seen before?

So this is, um, what's reported as ransomware, and ransomware historically holds data for ransom and makes the, you know, victim pay to get their data back. In this case, it seems that they are attacking essentially, you know, the infrastructure of the network of the publisher to hold their processes and systems hostage so they can't print, so they can't add certain functions and systems. And that way they will charge them ransom so they can go back online. And they see this as a high-value target.

Robert, good morning. Mitroshel, what do businesses do to sort of prevent this? Because it seems to me that this is not a new phenomenon, but businesses are still underinvested in terms of being preventative. Whether it's training their employees or the like, being preventative to not let this happen to them?

Yeah, so there's two things going on here. The preventative part, I'll get to in a second, but they have redundant systems, or they should have redundant systems that will allow them to go back online pretty quickly by essentially flipping a switch. Otherwise, proactively, you know, there's all kinds of hardware, software, security awareness training, you know, antivirus, anti-spyware, anti-phishing, a firewall, not clicking the wrong links, having a virtual private network installed to encrypt all your Wi-Fi connections and so forth. You know, that's all fundamental stuff, but bad guys, you know, they're 24/7, 365. This is how they get paid. They're going to find their way in if you don't have your defenses up 24/7.

Hey, Robert, it seems like, you know, that these attacks are getting more and more prevalent and sophisticated. We have the Consumer Electronics Show coming up in Vegas this coming week. Everyone's excited about it. We're going to hear all about the Internet of Things. Are all these devices that are going to have some sort of connection, are these especially vulnerable? And what are companies doing to protect consumers and users of these devices?

Yeah, these devices, we call them endpoints, right? An endpoint's an IoT, a camera, it could be a printer. And if those devices aren't properly secured, then that's like the back door, the easiest path of least resistance to get in. Hardware manufacturers, they're often quick to get their hardware out. They don't necessarily think about the application security process. And so it's only discovered as a flaw once it's out there and vulnerable. So then they patch it. But consumers, businesses, they should do what they can to update the firmware, update the software, making sure that they're proactive regarding all of their devices' security.

And then I want to move on to this story. A new privacy worry— we're talking about consumers— there's a new report from Privacy International cited by the Financial Times saying at least 20 out of the 34 popular Android apps, including Kayak, Skyscanner, TripAdvisor, and MyFitnessPal, are sharing data with Facebook without consumer consent. So it wasn't just Facebook just opening the door to app developers with our data, which was really the Cambridge Analytica scandal. It's also moving in the other direction. Facebook stock lost about a quarter of its value in the last— this year. Robert, your reaction to this? When is it going to stop?

Yeah, it's not going to stop. So you have a fitness tracker and there's an app connected to it, right? It's not going to stop. You know, they're going to always find a way to monetize this data. And yeah, you know, you have all types of laws in place, European, American, that are designed to prevent it, but they're still going to do it in some way, shape, or form. They're going to apologize later. And in the end, you know, they're getting paid, so why not? Here you have a fitness tracker that you have connected to your phone, and you allow Facebook to access your data in some way because you might have agreed to it, and that's sending, you know, your heart rate It may be your location data, your pulse, whether you have high blood pressure. Do you want Facebook knowing that? Do you want advertisers and marketers knowing that? Do you want insurance companies knowing that? So it's up to you to disconnect and not allow that to happen.

Matty, given the fact that these social media companies have been the target of Washington kind of finally in the last year, to some comedic effect. In these, in some of these hearings. What happens in the new year? Because again, that is one of the major questions for technology investors is regulation.

Exactly. We actually haven't seen as much of exposure of tech companies to Capitol Hill as I think we will in the coming year because Democrats now have those juiced-up oversight responsibilities taking over a chamber of Congress. I think we will certainly see a lot of this IRB directed at tech. But as we just saw, this is not simply a tech problem. I think Facebook takes the load of the criticism on these data protection concerns. Concerns, as it should, because it doesn't do enough to protect our data. But listen, all of these companies are profiting on data as well. This is no longer just a tech company problem. It is a wholesale consumer problem because every company collects data on you. We forget that it's not just about these companies amassing consumers. It's about what they do with that consumer data. So this needs to be a long-term goal of regulators. And I'm not someone who thinks that we need to get regulators to step in right away. But I think if there's going to be oversight of companies, it needs to be that focus on data, securing, securing data for consumers instead of saying that one company is at fault here.

Robert, a final word to you, because I bought my mother a Kindle for the holidays, and when I went to set it up, what is one of the first things that the device asks is, would you like to connect to your Facebook account? And the answer, of course, was no. But again, so ultimately it's up to the consumer to do something about this, like you said.

Yeah, unfortunately, you know, the public are— they, they see these free services and what they don't realize is that they are the product. And they are what's for sale. And until you as a consumer recognize that, you're going to just keep freely sharing your data and ultimately getting bit by these big companies.

Robert, good to see you, and a very happy New Year to you. Robert Siciliano, nice to see you.