Jump to content

DataSpii

From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by Cory Gordon (talk | contribs) at 18:58, 31 July 2020 (Tagging of 3 WikiProjects and change to content.). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.
WikiProject iconComputer security: Computing Unassessed
WikiProject iconThis article is within the scope of WikiProject Computer security, a collaborative effort to improve the coverage of computer security on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.
???This article has not yet received a rating on Wikipedia's content assessment scale.
???This article has not yet received a rating on the project's importance scale.
Taskforce icon
This article is supported by WikiProject Computing.
Things you can help WikiProject Computer security with:
Article alerts are available, updated by AAlertBot. More information...
  • Review importance and quality of existing articles
  • Identify categories related to Computer Security
  • Tag related articles
  • Identify articles for creation (see also: Article requests)
  • Identify articles for improvement
  • Create the Project Navigation Box including lists of adopted articles, requested articles, reviewed articles, etc.
  • Find editors who have shown interest in this subject and ask them to take a look here.
WikiProject iconMass surveillance Unassessed
WikiProject iconDataSpii is within the scope of WikiProject Mass surveillance, which aims to improve Wikipedia's coverage of mass surveillance and mass surveillance-related topics. If you would like to participate, visit the project page, or contribute to the discussion.
???This article has not yet received a rating on Wikipedia's content assessment scale.
???This article has not yet received a rating on the project's importance scale.
WikiProject iconComputer science Unassessed
WikiProject iconThis article is within the scope of WikiProject Computer science, a collaborative effort to improve the coverage of Computer science related articles on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.
???This article has not yet received a rating on Wikipedia's content assessment scale.
???This article has not yet received a rating on the project's importance scale.
Things you can help WikiProject Computer science with:


  • Comment: When online versions of references are available it is expected that you will provide the full citation. {{Cite news}} has a very full list of parameters, not all of which have to be used.
    :A further tip for your next review is that paragraphs should not be so black as to be impenetrable. Long lists of names are unreadable Fiddle Faddle 13:56, 13 July 2020 (UTC)

DataSpii (pronounced data-spy) is a leak that directly compromised the private data of as many as 4 million Chrome and Firefox users via at least eight browser extensions.[1][2][3] The eight browser extensions included Hover Zoom, SpeakIt!, SuperZoom, SaveFrom.net Helper, FairShare Unlock, PanelMeasurement, Branded Surveys, and Panel Community Surveys. The private data included personally identifiable information (PII), corporate information (CI), and government information (GI). DataSpii impacted the Pentagon, Zoom, Bank of America, Sony, Kaiser Permanente, Apple, Facebook, Microsoft, Amazon, Symantec, FireEye, Trend Micro, Boeing, SpaceX, and Palo Alto Networks.[4][5] Highly sensitive information (e.g., private network topology) associated with these corporations and agencies was intercepted and sent to foreign-owned entities.[6]

The data was made publicly available via Nacho Analytics (NA), a marketing intelligence company which described itself as "god mode for the internet."[7] Both paid and free-trial members of NA were provided access to the leaked data. Upon signing up for NA membership, members were then provided access to the data via a Google Analytics account.

DataSpii leaked un-redacted information related to medical records, tax returns, GPS location, travel itinerary, genealogy, usernames, passwords, credit cards, genetic profiles, company memos, employee tasks, API keys, proprietary source code, LAN environment, firewall access codes, proprietary secrets, operational materials, and zero-day vulnerabilities.[4]

DataSpii was discovered and elucidated by cybersecurity researcher Sam Jadali. By requesting data for a single domain via the NA service, Jadali was able to observe what staff members at thousands of companies were working on in near real-time. The NA website stated it collected data from millions of opt-in users. Jadali, along with journalists from Ars Technica and The Washington Post, interviewed impacted users, including individuals and major corporations.[1][2] According to the interviews, the impacted users did not consent to such collection.

References

  1. ^ a b Goodin, Dan (2019-07-18). "My browser, the spy: How extensions slurped up browsing histories from 4M users". Ars Technica. Retrieved 2020-07-28.
  2. ^ a b Fowler, Geoffrey (2019-07-18). "Perspective: I found your data. It's for sale". Washington Post. Retrieved 2020-07-28.{{cite web}}: CS1 maint: url-status (link)
  3. ^ O'Flaherty, Kate (2019-07-19). "Data Leak Warning Issued To Millions Of Google Chrome And Firefox Users". Forbes. Retrieved 2020-07-28.{{cite web}}: CS1 maint: url-status (link)
  4. ^ a b Jadali, Sam (2019-07-18). "DataSpii - A global catastrophic data leak via browser extensions". Security with Sam. Retrieved 2020-07-28.{{cite web}}: CS1 maint: url-status (link)
  5. ^ Sam Jadali [@sam_jadali] (5 December 2019). "Multibillion dollar cybersecurity companies leaked client data including government (Pentagon) and corporate data (BofA, AT&T, Novartis, Orange, and KP) in the #DataSpii browser extension leak. See attached for heavily redacted screenshot" (Tweet) – via Twitter.
  6. ^ Goodin, Dan (2019-07-18). "More on DataSpii: How extensions hide their data grabs—and how they're discovered". Ars Technica. Retrieved 2020-07-28.
  7. ^ Dreyfuss, Emily (2019-07-20). "Browser Extensions Scraped Data From Millions of People". Wired. ISSN 1059-1028. Retrieved 2020-07-28.{{cite news}}: CS1 maint: url-status (link)