This is a serious one. A vulnerability exists on Android that will allow the phone to be hacked simply by viewing a malicious PNG image.
The most severe of these issues is a critical security vulnerability in Framework that could allow a remote attacker using a specially crafted PNG file to execute arbitrary code within the context of a privileged process. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed.
Someone is openly selling aggregated databases containing PII (personally identifiable information) of Singaporeans – names, email, mobile, address, company, job title, etc. and even offering a CNY promotion of “only” SGD 688 for a total of 8 databases.
Some of the sample databases – which I won’t embed here – are not properly blurred out – you can even make out the name, email, mobile and address of the individual.
The FAQ says that:
Q: Is It Legal To Purchase Databases?
Yes. It is legal to purchase database for marketing or advertising purposes. All information in our databases are publicly available data which can be found online or offline.
That is blatantly false.
The organization behind this website claims to be SPADB, which doesn’t appear to be a legitimate company. According to archive.org, they seem to have been operating since 2015. It has another similar looking website which sells databases of registered property agents.
The server hosting the website seems to be based in Singapore, so there’s a possibility that PDPC or SingCert can do something about it.
Singapore’s most comprehensive business & consumer databases with over 1 million contact list. Buy 1 Get 6 Free. 7 databases For just one low price. 100% Lowest Price Guaranteed!
The cost of data is not just the bytes that are required to store them. Increasingly laws will target companies for over-collecting, misusing, and not doing enough to protect PII data.
California recently passed an extremely powerful, far-reaching law, the California Consumer Privacy Act (CCPA), that will likely drive even more change than the GDPR. Here’s what your dev team needs to know and how to prepare.