The World Cup is here, which is great news for fans (and my social media feeds, thankfully), but as with any major event, joy and camaraderie are only one side of the coin. On the other side, scammers are eager to part fans from their money with fake streaming sites, fake ticket schemes, scam betting apps, and shady crypto deals. Thankfully, we have tips to help you steer clear of them . But that’s far from the only happening in cybersecurity this week. With the rise of age-verification laws and other location-based censorship of web content, VPN use is skyrocketing. In India, for instance, people are using VPNs to circumvent a national Telegram ban imposed to prevent cheating on national exams. In general, we’re all for it: A VPN is an important part of your security toolkit, and it can keep prying eyes, whether they’re your ISP , your government, advertisers, or hackers, off of your data and browsing habits . But it’s not always legal, sadly, so we decided to look at where VPN use is OK, and where using one will get you into trouble . You’ll see some countries on our map flagged in red that you might expect, but there are a few others with troubling signs that you may not. It’s worth noting, though, that despite the marketing, a VPN isn’t a panacea to internet security, and it can’t do everything. Is the rumor that you can get cheaper airfare using a VPN true? We tested it, and it doesn’t really work . Using a VPN for online banking? Love the spirit, but you’re making more problems for yourself than you’re solving . Now then, let’s take a look at what else is going on in the infosec world this week. Cops Keep Getting Arrested for Using Flock to Stalk People Ever since we reported on the invasion of Flock cameras into communities around the country (and the subsequent blowback from those communities), I’ve been paying closer attention to the company and its relationship with law enforcement. Unfortunately, that relationship continues to look pretty concerning, as 404 Media reported this week that police officers with access to the system can’t stop using it to stalk people . In 404 Media’s story, it notes that around the country, there have been at least a dozen cases where police officers have used their access to Flock cameras and their data to illegally stalk or harass people, including one case where an officer ran his ex-girlfriend’s license plate number through the Flock database at least 69 times, and then searched for the license plate numbers of her parents several more times. Even the officer’s coworkers noticed his behavior, and told him to stop (which he didn’t, according to the report). This is precisely the problem with broad surveillance tools and their explosion in popularity among law enforcement and local governments lately: Even when you have guidelines for appropriate use or even limit surveillance systems to need-to-know individuals, there’ll always be people who just use it to prey on others or target vulnerable groups: something we ideally would have all learned back in the Snowden era. Steam Workshop Abused to Spread Malware Through Wallpaper Engine This one hurts, because I’m a big Wallpaper Engine fan. If you’re not familiar, Wallpaper Engine is an app that runs in the background on Windows PCs, allowing you to display community-created animated wallpapers on your desktop, along with tools like clocks, weather widgets, and other customization options. The community-created wallpapers range from animated images and full videos to interactive webpages and full applications that run on the client PC, and they’re usually found in the Steam Workshop. In this case, the trouble, reported by Bleeping Computer , is that bad actors have been using the Steam Workshop to spread malware to Wallpaper Engine users. Infected wallpapers can leave backdoors for future exploitation, hijack your Steam account, or mine crypto on your computer. In this case, the exploit uses application wallpapers, which, unlike media wallpapers, are full executables that run whenever Wallpaper Engine opens them. The legitimate ones are widgets, games, or other utilities to add some customization to your desktop, but since they’re just applications, malicious ones run just the same as the legitimate ones do, and in the absence of up-to-date antivirus software or a good security suite , anything goes. To its credit, Steam took down all the malicious applications that security firm Kaspersky , which discovered the issue, reported to it. Unfortunately, for some of those users, many of the apps had already been downloaded thousands (and in some cases tens of thousands) of times. Maine Forced to Take Down Data Breach Portal After Fake Notices Filed With Authorities In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some verification in place to confirm the veracity of the reports. As for who submitted the reports in the first place? Whether it was a deliberate attempt at misinformation (as in, the person who submitted it knew that journalists use the database for reporting) or someone just testing the waters to see if they could make some mischief, we may never know.
With the rise of age-verification laws and other location-based censorship of web content, VPN use is skyrocketing. In India, for instance, people are using VPNs to circumvent a national Telegram ban imposed to prevent cheating on national exams. In general, we’re all for it: A VPN is an important part of your security toolkit, and it can keep prying eyes, whether they’re your ISP , your government, advertisers, or hackers, off of your data and browsing habits . But it’s not always legal, sadly, so we decided to look at where VPN use is OK, and where using one will get you into trouble . You’ll see some countries on our map flagged in red that you might expect, but there are a few others with troubling signs that you may not. It’s worth noting, though, that despite the marketing, a VPN isn’t a panacea to internet security, and it can’t do everything. Is the rumor that you can get cheaper airfare using a VPN true? We tested it, and it doesn’t really work . Using a VPN for online banking? Love the spirit, but you’re making more problems for yourself than you’re solving . Now then, let’s take a look at what else is going on in the infosec world this week. Cops Keep Getting Arrested for Using Flock to Stalk People Ever since we reported on the invasion of Flock cameras into communities around the country (and the subsequent blowback from those communities), I’ve been paying closer attention to the company and its relationship with law enforcement. Unfortunately, that relationship continues to look pretty concerning, as 404 Media reported this week that police officers with access to the system can’t stop using it to stalk people . In 404 Media’s story, it notes that around the country, there have been at least a dozen cases where police officers have used their access to Flock cameras and their data to illegally stalk or harass people, including one case where an officer ran his ex-girlfriend’s license plate number through the Flock database at least 69 times, and then searched for the license plate numbers of her parents several more times. Even the officer’s coworkers noticed his behavior, and told him to stop (which he didn’t, according to the report). This is precisely the problem with broad surveillance tools and their explosion in popularity among law enforcement and local governments lately: Even when you have guidelines for appropriate use or even limit surveillance systems to need-to-know individuals, there’ll always be people who just use it to prey on others or target vulnerable groups: something we ideally would have all learned back in the Snowden era. Steam Workshop Abused to Spread Malware Through Wallpaper Engine This one hurts, because I’m a big Wallpaper Engine fan. If you’re not familiar, Wallpaper Engine is an app that runs in the background on Windows PCs, allowing you to display community-created animated wallpapers on your desktop, along with tools like clocks, weather widgets, and other customization options. The community-created wallpapers range from animated images and full videos to interactive webpages and full applications that run on the client PC, and they’re usually found in the Steam Workshop. In this case, the trouble, reported by Bleeping Computer , is that bad actors have been using the Steam Workshop to spread malware to Wallpaper Engine users. Infected wallpapers can leave backdoors for future exploitation, hijack your Steam account, or mine crypto on your computer. In this case, the exploit uses application wallpapers, which, unlike media wallpapers, are full executables that run whenever Wallpaper Engine opens them. The legitimate ones are widgets, games, or other utilities to add some customization to your desktop, but since they’re just applications, malicious ones run just the same as the legitimate ones do, and in the absence of up-to-date antivirus software or a good security suite , anything goes. To its credit, Steam took down all the malicious applications that security firm Kaspersky , which discovered the issue, reported to it. Unfortunately, for some of those users, many of the apps had already been downloaded thousands (and in some cases tens of thousands) of times. Maine Forced to Take Down Data Breach Portal After Fake Notices Filed With Authorities In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some verification in place to confirm the veracity of the reports. As for who submitted the reports in the first place? Whether it was a deliberate attempt at misinformation (as in, the person who submitted it knew that journalists use the database for reporting) or someone just testing the waters to see if they could make some mischief, we may never know.
In general, we’re all for it: A VPN is an important part of your security toolkit, and it can keep prying eyes, whether they’re your ISP , your government, advertisers, or hackers, off of your data and browsing habits . But it’s not always legal, sadly, so we decided to look at where VPN use is OK, and where using one will get you into trouble . You’ll see some countries on our map flagged in red that you might expect, but there are a few others with troubling signs that you may not. It’s worth noting, though, that despite the marketing, a VPN isn’t a panacea to internet security, and it can’t do everything. Is the rumor that you can get cheaper airfare using a VPN true? We tested it, and it doesn’t really work . Using a VPN for online banking? Love the spirit, but you’re making more problems for yourself than you’re solving . Now then, let’s take a look at what else is going on in the infosec world this week. Cops Keep Getting Arrested for Using Flock to Stalk People Ever since we reported on the invasion of Flock cameras into communities around the country (and the subsequent blowback from those communities), I’ve been paying closer attention to the company and its relationship with law enforcement. Unfortunately, that relationship continues to look pretty concerning, as 404 Media reported this week that police officers with access to the system can’t stop using it to stalk people . In 404 Media’s story, it notes that around the country, there have been at least a dozen cases where police officers have used their access to Flock cameras and their data to illegally stalk or harass people, including one case where an officer ran his ex-girlfriend’s license plate number through the Flock database at least 69 times, and then searched for the license plate numbers of her parents several more times. Even the officer’s coworkers noticed his behavior, and told him to stop (which he didn’t, according to the report). This is precisely the problem with broad surveillance tools and their explosion in popularity among law enforcement and local governments lately: Even when you have guidelines for appropriate use or even limit surveillance systems to need-to-know individuals, there’ll always be people who just use it to prey on others or target vulnerable groups: something we ideally would have all learned back in the Snowden era. Steam Workshop Abused to Spread Malware Through Wallpaper Engine This one hurts, because I’m a big Wallpaper Engine fan. If you’re not familiar, Wallpaper Engine is an app that runs in the background on Windows PCs, allowing you to display community-created animated wallpapers on your desktop, along with tools like clocks, weather widgets, and other customization options. The community-created wallpapers range from animated images and full videos to interactive webpages and full applications that run on the client PC, and they’re usually found in the Steam Workshop. In this case, the trouble, reported by Bleeping Computer , is that bad actors have been using the Steam Workshop to spread malware to Wallpaper Engine users. Infected wallpapers can leave backdoors for future exploitation, hijack your Steam account, or mine crypto on your computer. In this case, the exploit uses application wallpapers, which, unlike media wallpapers, are full executables that run whenever Wallpaper Engine opens them. The legitimate ones are widgets, games, or other utilities to add some customization to your desktop, but since they’re just applications, malicious ones run just the same as the legitimate ones do, and in the absence of up-to-date antivirus software or a good security suite , anything goes. To its credit, Steam took down all the malicious applications that security firm Kaspersky , which discovered the issue, reported to it. Unfortunately, for some of those users, many of the apps had already been downloaded thousands (and in some cases tens of thousands) of times. Maine Forced to Take Down Data Breach Portal After Fake Notices Filed With Authorities In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some verification in place to confirm the veracity of the reports. As for who submitted the reports in the first place? Whether it was a deliberate attempt at misinformation (as in, the person who submitted it knew that journalists use the database for reporting) or someone just testing the waters to see if they could make some mischief, we may never know.
It’s worth noting, though, that despite the marketing, a VPN isn’t a panacea to internet security, and it can’t do everything. Is the rumor that you can get cheaper airfare using a VPN true? We tested it, and it doesn’t really work . Using a VPN for online banking? Love the spirit, but you’re making more problems for yourself than you’re solving . Now then, let’s take a look at what else is going on in the infosec world this week. Cops Keep Getting Arrested for Using Flock to Stalk People Ever since we reported on the invasion of Flock cameras into communities around the country (and the subsequent blowback from those communities), I’ve been paying closer attention to the company and its relationship with law enforcement. Unfortunately, that relationship continues to look pretty concerning, as 404 Media reported this week that police officers with access to the system can’t stop using it to stalk people . In 404 Media’s story, it notes that around the country, there have been at least a dozen cases where police officers have used their access to Flock cameras and their data to illegally stalk or harass people, including one case where an officer ran his ex-girlfriend’s license plate number through the Flock database at least 69 times, and then searched for the license plate numbers of her parents several more times. Even the officer’s coworkers noticed his behavior, and told him to stop (which he didn’t, according to the report). This is precisely the problem with broad surveillance tools and their explosion in popularity among law enforcement and local governments lately: Even when you have guidelines for appropriate use or even limit surveillance systems to need-to-know individuals, there’ll always be people who just use it to prey on others or target vulnerable groups: something we ideally would have all learned back in the Snowden era. Steam Workshop Abused to Spread Malware Through Wallpaper Engine This one hurts, because I’m a big Wallpaper Engine fan. If you’re not familiar, Wallpaper Engine is an app that runs in the background on Windows PCs, allowing you to display community-created animated wallpapers on your desktop, along with tools like clocks, weather widgets, and other customization options. The community-created wallpapers range from animated images and full videos to interactive webpages and full applications that run on the client PC, and they’re usually found in the Steam Workshop. In this case, the trouble, reported by Bleeping Computer , is that bad actors have been using the Steam Workshop to spread malware to Wallpaper Engine users. Infected wallpapers can leave backdoors for future exploitation, hijack your Steam account, or mine crypto on your computer. In this case, the exploit uses application wallpapers, which, unlike media wallpapers, are full executables that run whenever Wallpaper Engine opens them. The legitimate ones are widgets, games, or other utilities to add some customization to your desktop, but since they’re just applications, malicious ones run just the same as the legitimate ones do, and in the absence of up-to-date antivirus software or a good security suite , anything goes. To its credit, Steam took down all the malicious applications that security firm Kaspersky , which discovered the issue, reported to it. Unfortunately, for some of those users, many of the apps had already been downloaded thousands (and in some cases tens of thousands) of times. Maine Forced to Take Down Data Breach Portal After Fake Notices Filed With Authorities In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some verification in place to confirm the veracity of the reports. As for who submitted the reports in the first place? Whether it was a deliberate attempt at misinformation (as in, the person who submitted it knew that journalists use the database for reporting) or someone just testing the waters to see if they could make some mischief, we may never know.
Now then, let’s take a look at what else is going on in the infosec world this week. Cops Keep Getting Arrested for Using Flock to Stalk People Ever since we reported on the invasion of Flock cameras into communities around the country (and the subsequent blowback from those communities), I’ve been paying closer attention to the company and its relationship with law enforcement. Unfortunately, that relationship continues to look pretty concerning, as 404 Media reported this week that police officers with access to the system can’t stop using it to stalk people . In 404 Media’s story, it notes that around the country, there have been at least a dozen cases where police officers have used their access to Flock cameras and their data to illegally stalk or harass people, including one case where an officer ran his ex-girlfriend’s license plate number through the Flock database at least 69 times, and then searched for the license plate numbers of her parents several more times. Even the officer’s coworkers noticed his behavior, and told him to stop (which he didn’t, according to the report). This is precisely the problem with broad surveillance tools and their explosion in popularity among law enforcement and local governments lately: Even when you have guidelines for appropriate use or even limit surveillance systems to need-to-know individuals, there’ll always be people who just use it to prey on others or target vulnerable groups: something we ideally would have all learned back in the Snowden era. Steam Workshop Abused to Spread Malware Through Wallpaper Engine This one hurts, because I’m a big Wallpaper Engine fan. If you’re not familiar, Wallpaper Engine is an app that runs in the background on Windows PCs, allowing you to display community-created animated wallpapers on your desktop, along with tools like clocks, weather widgets, and other customization options. The community-created wallpapers range from animated images and full videos to interactive webpages and full applications that run on the client PC, and they’re usually found in the Steam Workshop. In this case, the trouble, reported by Bleeping Computer , is that bad actors have been using the Steam Workshop to spread malware to Wallpaper Engine users. Infected wallpapers can leave backdoors for future exploitation, hijack your Steam account, or mine crypto on your computer. In this case, the exploit uses application wallpapers, which, unlike media wallpapers, are full executables that run whenever Wallpaper Engine opens them. The legitimate ones are widgets, games, or other utilities to add some customization to your desktop, but since they’re just applications, malicious ones run just the same as the legitimate ones do, and in the absence of up-to-date antivirus software or a good security suite , anything goes. To its credit, Steam took down all the malicious applications that security firm Kaspersky , which discovered the issue, reported to it. Unfortunately, for some of those users, many of the apps had already been downloaded thousands (and in some cases tens of thousands) of times. Maine Forced to Take Down Data Breach Portal After Fake Notices Filed With Authorities In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some verification in place to confirm the veracity of the reports. As for who submitted the reports in the first place? Whether it was a deliberate attempt at misinformation (as in, the person who submitted it knew that journalists use the database for reporting) or someone just testing the waters to see if they could make some mischief, we may never know.
Ever since we reported on the invasion of Flock cameras into communities around the country (and the subsequent blowback from those communities), I’ve been paying closer attention to the company and its relationship with law enforcement. Unfortunately, that relationship continues to look pretty concerning, as 404 Media reported this week that police officers with access to the system can’t stop using it to stalk people . In 404 Media’s story, it notes that around the country, there have been at least a dozen cases where police officers have used their access to Flock cameras and their data to illegally stalk or harass people, including one case where an officer ran his ex-girlfriend’s license plate number through the Flock database at least 69 times, and then searched for the license plate numbers of her parents several more times. Even the officer’s coworkers noticed his behavior, and told him to stop (which he didn’t, according to the report). This is precisely the problem with broad surveillance tools and their explosion in popularity among law enforcement and local governments lately: Even when you have guidelines for appropriate use or even limit surveillance systems to need-to-know individuals, there’ll always be people who just use it to prey on others or target vulnerable groups: something we ideally would have all learned back in the Snowden era. Steam Workshop Abused to Spread Malware Through Wallpaper Engine This one hurts, because I’m a big Wallpaper Engine fan. If you’re not familiar, Wallpaper Engine is an app that runs in the background on Windows PCs, allowing you to display community-created animated wallpapers on your desktop, along with tools like clocks, weather widgets, and other customization options. The community-created wallpapers range from animated images and full videos to interactive webpages and full applications that run on the client PC, and they’re usually found in the Steam Workshop. In this case, the trouble, reported by Bleeping Computer , is that bad actors have been using the Steam Workshop to spread malware to Wallpaper Engine users. Infected wallpapers can leave backdoors for future exploitation, hijack your Steam account, or mine crypto on your computer. In this case, the exploit uses application wallpapers, which, unlike media wallpapers, are full executables that run whenever Wallpaper Engine opens them. The legitimate ones are widgets, games, or other utilities to add some customization to your desktop, but since they’re just applications, malicious ones run just the same as the legitimate ones do, and in the absence of up-to-date antivirus software or a good security suite , anything goes. To its credit, Steam took down all the malicious applications that security firm Kaspersky , which discovered the issue, reported to it. Unfortunately, for some of those users, many of the apps had already been downloaded thousands (and in some cases tens of thousands) of times. Maine Forced to Take Down Data Breach Portal After Fake Notices Filed With Authorities In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some verification in place to confirm the veracity of the reports. As for who submitted the reports in the first place? Whether it was a deliberate attempt at misinformation (as in, the person who submitted it knew that journalists use the database for reporting) or someone just testing the waters to see if they could make some mischief, we may never know.
In 404 Media’s story, it notes that around the country, there have been at least a dozen cases where police officers have used their access to Flock cameras and their data to illegally stalk or harass people, including one case where an officer ran his ex-girlfriend’s license plate number through the Flock database at least 69 times, and then searched for the license plate numbers of her parents several more times. Even the officer’s coworkers noticed his behavior, and told him to stop (which he didn’t, according to the report). This is precisely the problem with broad surveillance tools and their explosion in popularity among law enforcement and local governments lately: Even when you have guidelines for appropriate use or even limit surveillance systems to need-to-know individuals, there’ll always be people who just use it to prey on others or target vulnerable groups: something we ideally would have all learned back in the Snowden era. Steam Workshop Abused to Spread Malware Through Wallpaper Engine This one hurts, because I’m a big Wallpaper Engine fan. If you’re not familiar, Wallpaper Engine is an app that runs in the background on Windows PCs, allowing you to display community-created animated wallpapers on your desktop, along with tools like clocks, weather widgets, and other customization options. The community-created wallpapers range from animated images and full videos to interactive webpages and full applications that run on the client PC, and they’re usually found in the Steam Workshop. In this case, the trouble, reported by Bleeping Computer , is that bad actors have been using the Steam Workshop to spread malware to Wallpaper Engine users. Infected wallpapers can leave backdoors for future exploitation, hijack your Steam account, or mine crypto on your computer. In this case, the exploit uses application wallpapers, which, unlike media wallpapers, are full executables that run whenever Wallpaper Engine opens them. The legitimate ones are widgets, games, or other utilities to add some customization to your desktop, but since they’re just applications, malicious ones run just the same as the legitimate ones do, and in the absence of up-to-date antivirus software or a good security suite , anything goes. To its credit, Steam took down all the malicious applications that security firm Kaspersky , which discovered the issue, reported to it. Unfortunately, for some of those users, many of the apps had already been downloaded thousands (and in some cases tens of thousands) of times. Maine Forced to Take Down Data Breach Portal After Fake Notices Filed With Authorities In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some verification in place to confirm the veracity of the reports. As for who submitted the reports in the first place? Whether it was a deliberate attempt at misinformation (as in, the person who submitted it knew that journalists use the database for reporting) or someone just testing the waters to see if they could make some mischief, we may never know.
This is precisely the problem with broad surveillance tools and their explosion in popularity among law enforcement and local governments lately: Even when you have guidelines for appropriate use or even limit surveillance systems to need-to-know individuals, there’ll always be people who just use it to prey on others or target vulnerable groups: something we ideally would have all learned back in the Snowden era. Steam Workshop Abused to Spread Malware Through Wallpaper Engine This one hurts, because I’m a big Wallpaper Engine fan. If you’re not familiar, Wallpaper Engine is an app that runs in the background on Windows PCs, allowing you to display community-created animated wallpapers on your desktop, along with tools like clocks, weather widgets, and other customization options. The community-created wallpapers range from animated images and full videos to interactive webpages and full applications that run on the client PC, and they’re usually found in the Steam Workshop. In this case, the trouble, reported by Bleeping Computer , is that bad actors have been using the Steam Workshop to spread malware to Wallpaper Engine users. Infected wallpapers can leave backdoors for future exploitation, hijack your Steam account, or mine crypto on your computer. In this case, the exploit uses application wallpapers, which, unlike media wallpapers, are full executables that run whenever Wallpaper Engine opens them. The legitimate ones are widgets, games, or other utilities to add some customization to your desktop, but since they’re just applications, malicious ones run just the same as the legitimate ones do, and in the absence of up-to-date antivirus software or a good security suite , anything goes. To its credit, Steam took down all the malicious applications that security firm Kaspersky , which discovered the issue, reported to it. Unfortunately, for some of those users, many of the apps had already been downloaded thousands (and in some cases tens of thousands) of times. Maine Forced to Take Down Data Breach Portal After Fake Notices Filed With Authorities In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some verification in place to confirm the veracity of the reports. As for who submitted the reports in the first place? Whether it was a deliberate attempt at misinformation (as in, the person who submitted it knew that journalists use the database for reporting) or someone just testing the waters to see if they could make some mischief, we may never know.
This one hurts, because I’m a big Wallpaper Engine fan. If you’re not familiar, Wallpaper Engine is an app that runs in the background on Windows PCs, allowing you to display community-created animated wallpapers on your desktop, along with tools like clocks, weather widgets, and other customization options. The community-created wallpapers range from animated images and full videos to interactive webpages and full applications that run on the client PC, and they’re usually found in the Steam Workshop. In this case, the trouble, reported by Bleeping Computer , is that bad actors have been using the Steam Workshop to spread malware to Wallpaper Engine users. Infected wallpapers can leave backdoors for future exploitation, hijack your Steam account, or mine crypto on your computer. In this case, the exploit uses application wallpapers, which, unlike media wallpapers, are full executables that run whenever Wallpaper Engine opens them. The legitimate ones are widgets, games, or other utilities to add some customization to your desktop, but since they’re just applications, malicious ones run just the same as the legitimate ones do, and in the absence of up-to-date antivirus software or a good security suite , anything goes. To its credit, Steam took down all the malicious applications that security firm Kaspersky , which discovered the issue, reported to it. Unfortunately, for some of those users, many of the apps had already been downloaded thousands (and in some cases tens of thousands) of times. Maine Forced to Take Down Data Breach Portal After Fake Notices Filed With Authorities In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some verification in place to confirm the veracity of the reports. As for who submitted the reports in the first place? Whether it was a deliberate attempt at misinformation (as in, the person who submitted it knew that journalists use the database for reporting) or someone just testing the waters to see if they could make some mischief, we may never know.
Infected wallpapers can leave backdoors for future exploitation, hijack your Steam account, or mine crypto on your computer. In this case, the exploit uses application wallpapers, which, unlike media wallpapers, are full executables that run whenever Wallpaper Engine opens them. The legitimate ones are widgets, games, or other utilities to add some customization to your desktop, but since they’re just applications, malicious ones run just the same as the legitimate ones do, and in the absence of up-to-date antivirus software or a good security suite , anything goes. To its credit, Steam took down all the malicious applications that security firm Kaspersky , which discovered the issue, reported to it. Unfortunately, for some of those users, many of the apps had already been downloaded thousands (and in some cases tens of thousands) of times. Maine Forced to Take Down Data Breach Portal After Fake Notices Filed With Authorities In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some verification in place to confirm the veracity of the reports. As for who submitted the reports in the first place? Whether it was a deliberate attempt at misinformation (as in, the person who submitted it knew that journalists use the database for reporting) or someone just testing the waters to see if they could make some mischief, we may never know.
To its credit, Steam took down all the malicious applications that security firm Kaspersky , which discovered the issue, reported to it. Unfortunately, for some of those users, many of the apps had already been downloaded thousands (and in some cases tens of thousands) of times. Maine Forced to Take Down Data Breach Portal After Fake Notices Filed With Authorities In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some verification in place to confirm the veracity of the reports. As for who submitted the reports in the first place? Whether it was a deliberate attempt at misinformation (as in, the person who submitted it knew that journalists use the database for reporting) or someone just testing the waters to see if they could make some mischief, we may never know.
In Maine, state law requires any company to notify the state attorney general’s office in the case of a data breach that impacts residents of the state within 30 days. That’s actually great, because it means that, in many cases, data breaches that might otherwise go unnoticed or be swept under the rug by the company responsible can see the light of day. In fact, we’ve cited Maine’s breach database several times before. However, the downside came last week when we learned that, while anyone can submit a breach report to the portal, there’s no independent verification behind the scenes to ensure those notifications are legitimate before they’re published. We got the news from the Bitdefender blog , but Bleeping Computer first reported that someone submitted two fraudulent breach reports (which were subsequently published), citing massive breaches of both Discord and VRChat, and when the publication contacted them to confirm, both responded that they didn’t file the notifications, and no breaches took place. Subsequently, Discord and VRChat contacted the Maine attorney general’s office, which, after reviewing the notifications, agreed that they were fake and took them down. The office also temporarily disabled the ability to file reports on the site, ostensibly until they can put some ...
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
