A humorous — however true — joke at TechCrunch is that the safety desk would possibly as effectively be referred to as the Division of Unhealthy Information, since, effectively, have you ever seen what we’ve coated of late? There’s a unending provide of devastating breaches, pervasive surveillance and dodgy startups flogging the downright harmful.

Generally although — albeit hardly ever — there are glimmers of hope that we need to share. Not least as a result of doing the suitable factor, even (and particularly) within the face of adversity, helps make the cyber-realm that little bit safer.

Bangladesh thanked a safety researcher for citizen knowledge leak discovery

When a safety researcher discovered {that a} Bangladeshi authorities web site was leaking the private data of its residents, clearly one thing was amiss. Viktor Markopoulos discovered the uncovered knowledge due to an inadvertently cached Google search end result, which uncovered citizen names, addresses, cellphone numbers and nationwide identification numbers from the affected web site. TechCrunch verified that the Bangladeshi authorities web site was leaking knowledge, however efforts to alert the federal government division have been initially met with silence. The info was so delicate, TechCrunch couldn’t say which authorities division was leaking the info, as this would possibly expose the info additional.

That’s when the nation’s pc emergency incident response workforce, also called CIRT, bought in contact and confirmed the leaking database had been fastened. The info was spilling from none aside from the nation’s delivery, demise and marriage registrar workplace. CIRT confirmed in a public discover that it had resolved the info spill and that it left “no stone unturned” to know how the leak occurred. Governments seldom deal with their scandals effectively, however an e mail from the federal government to the researcher thanking them for his or her discovering and reporting the bug exhibits the federal government’s willingness to have interaction over cybersecurity the place many different international locations won’t.

Apple throwing the kitchen sink at its spy ware drawback

It’s been greater than a decade since Apple dropped its now-infamous declare that Macs don’t get PC viruses (which whereas technically true, these phrases have plagued the corporate for years). Nowadays probably the most urgent risk to Apple gadgets is business spy ware, developed by personal corporations and bought to governments, which might punch a gap in our telephones’ safety defenses and steal our knowledge. It takes braveness to confess an issue, however Apple did precisely that by rolling out Speedy Safety Response fixes to repair safety bugs actively exploited by spy ware makers.

Apple rolled out its first emergency “hotfix” earlier this yr to iPhones, iPads and Macs. The thought was to roll out important patches that may very well be put in with out at all times having to reboot the gadget (arguably the ache level for the security-minded). Apple additionally has a setting referred to as Lockdown Mode, which limits sure gadget options on an Apple gadget which can be sometimes focused by spy ware. Apple says it’s not conscious of anybody utilizing Lockdown Mode who was subsequently hacked. The truth is, safety researchers say that Lockdown Mode has actively blocked ongoing focused hacks.

Taiwan’s authorities didn’t blink earlier than intervening after company knowledge leak

When a safety researcher informed TechCrunch {that a} ridesharing service referred to as iRent — run by Taiwanese automotive large Hotai Motors — was spilling real-time updating buyer knowledge to the web, it appeared like a easy repair. However after every week of emailing the corporate to resolve the continued knowledge spill — which included buyer names, cellular phone numbers and e mail addresses, and scans of buyer licenses — TechCrunch by no means heard again. It wasn’t till we contacted the Taiwanese authorities for assist disclosing the incident that we bought a response instantly.

Inside an hour of contacting the federal government, Taiwan’s minister for digital affairs Audrey Tang informed TechCrunch by e mail that the uncovered database had been flagged with Taiwan’s pc emergency incident response workforce, TWCERT, and was pulled offline. The pace at which the Taiwanese authorities responded was breathtakingly quick, however that wasn’t the tip of it. Taiwan subsequently fined Hotai Motors for failing to guard the info of greater than 400,000 clients, and was ordered to enhance its cybersecurity. In its aftermath, Taiwan’s vice premier Cheng Wen-tsan stated the positive of about $6,600 was “too mild” and proposed a change to the regulation that might enhance knowledge breach fines by tenfold.

Leaky U.S. court docket document programs sparked the proper of alarm

On the coronary heart of any judicial system is its court docket information system, the tech stack used for submitting and storing delicate authorized paperwork for court docket circumstances. These programs are sometimes on-line and searchable, whereas limiting entry to recordsdata that would in any other case jeopardize an ongoing continuing. However when safety researcher Jason Parker discovered a number of court docket document programs with extremely easy bugs that have been exploitable utilizing solely an online browser, Parker knew they needed to see that these bugs have been fastened.

Parker discovered and disclosed eight safety vulnerabilities in court docket information programs utilized in 5 U.S. states — and that was simply of their first batch disclosure. A few of the flaws have been fastened and a few stay excellent, and the responses from states have been combined. Florida’s Lee County took the heavy-handed (and self-owning) place of threatening the safety researcher with Florida’s anti-hacking legal guidelines. However the disclosures additionally despatched the proper of alarm. A number of state CISOs and officers accountable for court docket information programs throughout the U.S. noticed the disclosure as a possibility to examine their very own court docket document programs for vulnerabilities. Govtech is damaged (and is desperately underserved), however having researchers like Parker discovering and disclosing must-patch flaws makes the web safer — and the judicial system fairer — for everybody.

Google killed geofence warrants, even when it was higher late than by no means

It was Google’s greed pushed by adverts and perpetual development that set the stage for geofence warrants. These so-called “reverse” search warrants enable police and authorities companies to dumpster dive into Google’s huge shops of customers’ location knowledge to see if anybody was within the neighborhood on the time a criminal offense was dedicated. However the constitutionality (and accuracy) of those reverse-warrants have been referred to as into query and critics have referred to as on Google to place an finish to the surveillance follow it largely created to start with. After which, simply earlier than the vacation season, the reward of privateness: Google stated it could start storing location knowledge on customers’ gadgets and never centrally, successfully ending the flexibility for police to acquire real-time location from its servers.

Google’s transfer isn’t a panacea, and doesn’t undo the years of harm (or cease police from raiding historic knowledge saved by Google). However it would possibly nudge different corporations additionally topic to those sorts of reverse-search warrants — hey Microsoft, Snap, Uber and Yahoo (TechCrunch’s mother or father firm) — to observe go well with and cease storing customers’ delicate knowledge in a manner that makes it accessible to authorities calls for.