Cybersecurity News, TL;DR Summaries · everytldr

/ to search

Home Politics Economy Society World Technology Culture Sport Health Environment

AI Cybersecurity Devices Games Internet & Platforms Science

Politics Economy Society World Technology Culture Sport Health Environment

© 2026 everytldr

About Privacy Terms [email protected]

Cybersecurity
EFF Report: Mobile Ad SDKs Are Silently Sharing User Location Data
Many mobile advertising software development kits (SDKs) automatically funnel user location data to data brokers without the user's knowledge or meaningful consent. These SDKs facilitate data sharing through privacy-invasive defaults, financial incentives, and obscure documentation, often bypassing proper user authorization. The Electronic Frontier Foundation (EFF) warns that developers risk inadvertently exposing sensitive user information if they do not explicitly configure or disable these location-sharing features. Identified SDKs EFF researchers analyzed dozens of SDKs and highlighted four that share location data by default whenever a user grants app location permissions: InMobi BidMachine Verve’s HyBid Huawei’s Petal Ads Risks of Data Exposure Beyond targeted advertising, location data sourced from these libraries has been exploited for invasive surveillance, including: ICE investigations Global espionage tools Outing gay individuals Tracking union organizers Monitoring U.S. military personnel Call to Action Developers: Must scrutinize SDK settings and take responsibility for protecting user data rather than relying on default library configurations. Regulators and Legislators: Urged to implement stricter enforcement and policies to prevent apps from leaking location data to brokers and advertising networks.
EFF Deeplinks · 49 minutes ago
Cybersecurity
EFF Activities and Presentations at Summer Security Conferences in Las Vegas
The Electronic Frontier Foundation (EFF) is participating in BSidesLV, Black Hat USA, and DEF CON 34 to support the hacker community and advocate for digital rights. Attendees with legal concerns regarding sensitive research or talks can contact EFF at [email protected]. EFF booths will feature limited-edition DEF CON 34 t-shirts, membership sign-ups, and action alerts. Featured Presentations Privacy's Defender: Former Executive Director Cindy Cohn discusses her book and the history of hacker-led privacy protection. Ask EFF: A panel at BSidesLV covering policy, advocacy, and future tech trends. Section 1201 and Election Security: A session on DMCA limitations for security researchers. Mandatory Age Verification: A critique of age verification mandates by Alexis Hancock and Kenyatta Thomas. Counter-Surveillance with ESP32: Cooper Quintin demonstrates affordable, open-source tools for monitoring police, drones, and ALPR systems. Events and Contests EFF Benefit Poker Tournament: Held August 7 at the Horseshoe, proceeds support digital privacy initiatives. Beard and Mustache Contest: A community event held at the DEF CON Contest Stage on August 7. Tech Trivia Contest: A competitive challenge on August 8; participants may use 'bribes' to influence judges. Book Signing: Cindy Cohn signs copies of 'Privacy's Defender' at DEF CON on August 8.
EFF Deeplinks · 1 day ago
Cybersecurity
APC Statement to the UN Global Mechanism on ICTs and International Security
The Association for Progressive Communications (APC) urges the UN Global Mechanism to prioritize the security of vulnerable communities in global cybersecurity policy. APC advocates for inclusive, gender-sensitive policy frameworks that address the disproportionate impacts of cyber threats on women, LGBTQI+ individuals, and human rights defenders. The organization calls for direct engagement with civil society to provide empirical evidence on surveillance, hacking, and disinformation campaigns. Core Recommendations Inclusivity: Ensure the Global Mechanism provides a safe and enabling environment for civil society, researchers, and grassroots communities to participate. Addressing Cyber Mercenaries: Build on existing findings to further investigate and mitigate the harm caused by the global hack-for-hire spyware industry. Gender-Sensitive Legislation: Support member states in developing cybersecurity laws that explicitly address digital violence and include rapid response mechanisms. AI and Information Security: Examine the security vulnerabilities emerging from the rapid deployment of AI, particularly its impact on the Global Majority and public sector infrastructure. Implications for Governance The Global Mechanism must move past the initial exclusion of stakeholders to foster meaningful, multi-stakeholder collaboration. Policy development should utilize feminist-anchored approaches to technology, drawing on two decades of observed experience regarding digital rights and privacy. Cyber policy should avoid government overreach, ensuring that security measures protect citizens rather than enabling oppression.
APC · 1 week ago
Cybersecurity
What You Need to Know About California's DROP Tool
California residents can use the Delete Request and Opt-out Platform (DROP) to request that all registered data brokers delete their personal information and stop selling or sharing it. A single DROP request currently reaches 614 registered data brokers. Data brokers have until August 1, 2026, to begin complying with requests, after which they have 45 days to address each request. The tool is administered by the California Privacy Protection Agency (CPPA). Benefits and Scope Filing a request helps reduce unwanted spam, minimizes the number of entities holding personal data to improve cybersecurity, and increases control over how private information is used. The platform covers identifying information, such as Social Security numbers, geolocation, browsing history, and inferred data like political views or health assessments. Public records, such as vehicle or real estate ownership, are generally not subject to deletion. How to Use the System Visit the CPPA DROP website to file a request; applicants should have identifiers like an advertising ID or VIN ready for submission. Applicants must provide personal details for identity verification, which the agency is legally restricted from selling or sharing. Users receive a DROP ID to track their request status. Requests can be filed on behalf of others, provided the filer attests to their residency. Important Caveats The system does not stop companies from collecting new information in the future, meaning periodic updates to the request are advisable. DROP does not apply to non-data-broker companies like Google. The tool is currently restricted to California residents, though other states are monitoring the program for potential legislative adoption.
EFF Deeplinks · 2 weeks ago
Cybersecurity
APC Statement on the Global Mechanism for ICTs and International Security
The Association for Progressive Communications (APC) advocates for a human rights-based and gender-responsive framework in UN cybersecurity processes, specifically within the new Global Mechanism. APC emphasizes that civil society must act as critical implementation partners to ensure effective, inclusive, and secure global cyberspace policies. Roles for Civil Society Guidance on Norms: Civil society can collaborate with states to contextualize responsible behavior norms at national and local levels, develop checklists for key terms, and create tools to mainstream human rights and intersectional perspectives in national ICT and cybersecurity strategies. Research and Evidence: Organizations provide empirical evidence regarding the disproportionate impact of cyber threats—such as ransomware, disinformation, and surveillance—on vulnerable communities, including women, LGBTQIA+ individuals, and human rights defenders. Monitoring and Support: Civil society entities offer training, emergency response, and safety resources for human rights defenders, helping to track and document digital security threats. Governance Capacity Building: APC works to equip marginalized communities and women with the technical and policy expertise required to participate independently and safely in cybersecurity policy discussions. Recommendations for the Global Mechanism Programs must explicitly address the needs of those in the Global South whose unique threat landscapes are currently underrepresented. There is an urgent need to sustain funding and technical support to increase representation of women and diverse gender identities in cyber careers and policy-making.
APC · 2 weeks ago
Cybersecurity
Retailers Must Stop Selling Malware-Infected Android Devices
Amazon and other major online retailers are urged to implement systemic measures to stop the sale of Android devices pre-installed with malware. The "BADBOX" campaign affected 10 million uncertified Android Open Source Project (AOSP) devices, ranging from TV streaming boxes to digital picture frames. Compromised devices often use home networks to conduct illegal activities, and malicious actors continue to evolve tactics despite private sector takedowns. The Scope of the Problem Manufacturers often ship custom versions of Android that include hidden, malicious applications. These apps frequently lack visible icons, making them nearly impossible for average users to detect. Retailers currently handle these threats reactively, often addressing individual reports rather than blocking the supply chain. Call to Action for Retailers Companies like Amazon should leverage their vast anti-fraud resources to proactively identify and block malware-laden hardware. Retailers should improve consumer transparency by clearly communicating when similar products are subject to malware-related takedowns. The FBI has warned consumers to avoid cheap streaming devices that promise "free" access to premium sports and movie content, as these are common vectors for malware. Ecosystem Improvements Needed Greater emphasis is required on firmware transparency to verify the integrity of pre-installed software. Original Equipment Manufacturers (OEMs) must be held accountable for the security of their products. Retailers should better educate consumers, particularly during high-traffic shopping events like Prime Day, to help them make informed, safe purchasing decisions.
EFF Deeplinks · 1 month ago
Cybersecurity
How Russia Helped Build Iran’s Digital Prison
Iran’s internet shutdowns from December 2025 through January 2026 were the longest in the country's history. UN Special Rapporteur Mai Sato estimates casualties from the associated crackdowns range from 5,000 to 20,000. Iranian authorities have shifted to a "white-listed" model of internet access, blocking global connectivity by default through infrastructure-level control. The Role of Russian Technology Analyses suggest significant Russian influence in the deployment of Iran’s censorship architecture, specifically relying on Deep Packet Inspection (DPI) technology. Protei, a firm with roots in St. Petersburg, has supported Iran’s interception, traffic management, and monitoring systems. Documentation for Protei's DPI platform confirms its capability to identify, block, or throttle specific protocols, including messaging, file sharing, and VoIP services. Global Reach and Clients Protei serves numerous authoritarian regimes; its client list includes MTN Irancell in Iran, Tcell in Tajikistan, Uztelecom and Ucell in Uzbekistan, Zong 4G in Pakistan, and Safaricom in Kenya. Citizen Lab research from 2023 linked Protei to the development of mobile surveillance systems for the Iranian mobile provider Ariantel, covering user authentication and network signaling. Corporate Structure and Outlook In 2024, the Russian state-owned telecom operator Rostelecom entered into a joint venture with Protei, with industry experts suggesting a potential full acquisition by Rostelecom in the future. Despite international scrutiny, Protei maintains operations across branches in Russia, Jordan, and Estonia, claiming to support over 400 customers and 300 million subscribers worldwide.
Global Voices · 5 months ago