Skip to content

Menstrual tracking app data is a ‘gold mine’ for advertisers that risks women’s safety

Technology
144 74 0
  • 179 Stimmen
    13 Beiträge
    0 Aufrufe
    S
    I will be there. I will be armed. I will carry a gas mask. I will carry water and medical for my compatriots. I will not start shit. I will fight back if it comes to it.
  • Mega-BUNDLE Offer

    Technology technology
    2
    2
    0 Stimmen
    2 Beiträge
    3 Aufrufe
    T
    Unlock the ultimate toolkit for entrepreneurs, marketers, and content creators with the AISellers Mega-BUNDLE! This all-in-one package is packed with cutting-edge AI tools, templates, and automation workflows designed to skyrocket your productivity, simplify your sales funnel, and grow your online business—faster than ever before.
  • 138 Stimmen
    16 Beiträge
    3 Aufrufe
    H
    My ports are on the front of the router. No backdoors for me, checkmate Atheists.
  • 68 Stimmen
    7 Beiträge
    2 Aufrufe
    heythisisnttheymca@lemmy.worldH
    Worked with the US federal government for much of my professional career, mostly in an adversarial role. "reliable federal data sources" do not exist
  • Big Tech Wants to Become Its Own Bank

    Technology technology
    33
    1
    246 Stimmen
    33 Beiträge
    2 Aufrufe
    B
    I know, I was just being snarky
  • 3 Stimmen
    12 Beiträge
    2 Aufrufe
    guydudeman@lemmy.worldG
    Yeah, I don’t know how they’re doing it. They’re using some “zero trust” system. It’s beyond me.
  • 1 Stimmen
    8 Beiträge
    3 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.
  • 44 Stimmen
    4 Beiträge
    2 Aufrufe
    G
    It varies based on local legislation, so in some places paying ransoms is banned but it's by no means universal. It's totally valid to be against paying ransoms wherever possible, but it's not entirely black and white in some situations. For example, what if a hospital gets ransomed? Say they serve an area not served by other facilities, and if they can't get back online quickly people will die? Sounds dramatic, but critical public services get ransomed all the time and there are undeniable real world consequences. Recovery from ransomware can cost significantly more than a ransom payment if you're not prepared. It can also take months to years to recover, especially if you're simultaneously fighting to evict a persistent (annoyed, unpaid) threat actor from your environment. For the record I don't think ransoms should be paid in most scenarios, but I do think there is some nuance to consider here.