SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>DataSpii</title>

</head>

DataSpii

</h1>

</header>

DataSpii (pronounced data-spy) is a <a href="Internet_leak" title="Internet leak">leak</a> that directly compromised the private data of as many as 4 million <a href="Google_Chrome" title="Google Chrome">Chrome</a> and <a href="Mozilla_Firefox" class="mw-redirect" title="Mozilla Firefox">Firefox</a> users via at least eight <a href="Browser_extension" title="Browser extension">browser extensions</a>.<a href="#cite_note-:0-1">[1]</a><a href="#cite_note-:1-2">[2]</a><a href="#cite_note-3">[3]</a> The eight browser extensions included Hover Zoom, SpeakIt!, SuperZoom, SaveFrom.net Helper, FairShare Unlock, PanelMeasurement, Branded Surveys, and Panel Community Surveys.<a href="#cite_note-4">[4]</a> The private data included personally identifiable information (PII), corporate information (CI), and government information (GI). DataSpii impacted <a href="The_Pentagon" title="The Pentagon">the Pentagon</a>, <a href="Walmart" title="Walmart">Walmart</a>, <a href="AT%26T" title="AT&T">AT&T</a>, <a href="Zoom_(software)" title="Zoom (software)">Zoom</a>, <a href="Bank_of_America" title="Bank of America">Bank of America</a>, <a href="Sony" title="Sony">Sony</a>, <a href="Kaiser_Permanente" title="Kaiser Permanente">Kaiser Permanente</a>, <a href="Apple_Inc." title="Apple Inc.">Apple</a>, <a href="Facebook" title="Facebook">Facebook</a>, <a href="Microsoft" title="Microsoft">Microsoft</a>, <a href="Amazon_(company)" title="Amazon (company)">Amazon</a>, <a href="Gen_Digital" title="Gen Digital">Symantec</a>, <a href="FireEye" class="mw-redirect" title="FireEye">FireEye</a>, <a href="Trend_Micro" title="Trend Micro">Trend Micro</a>, <a href="Boeing" title="Boeing">Boeing</a>, <a href="Tesla%2C_Inc." title="Tesla, Inc.">Tesla</a>, <a href="SpaceX" title="SpaceX">SpaceX</a>, <a href="Pfizer" title="Pfizer">Pfizer</a>, and <a href="Palo_Alto_Networks" title="Palo Alto Networks">Palo Alto Networks</a>.<a href="#cite_note-:2-5">[5]</a><a href="#cite_note-6">[6]</a> Highly sensitive information (e.g., private network topology) associated with these corporations and agencies was intercepted and sent to foreign-owned entities.<a href="#cite_note-7">[7]</a>

The data was made publicly available via Nacho Analytics (NA), a marketing intelligence company which described itself as "god mode for the internet."<a href="#cite_note-8">[8]</a> Both paid and free-trial members of NA were provided access to the leaked data. Upon signing up for NA membership, members were then provided access to the data via a <a href="Google_Analytics" title="Google Analytics">Google Analytics</a> account.

DataSpii leaked un-redacted information related to medical records, tax returns, GPS location, travel itinerary, genealogy, usernames, passwords, credit cards, genetic profiles, company memos, employee tasks, API keys, proprietary source code, LAN environment, firewall access codes, proprietary secrets, operational materials, and zero-day vulnerabilities.<a href="#cite_note-:2-5">[5]</a>

DataSpii was discovered and elucidated by cybersecurity researcher Sam Jadali. By requesting data for a single domain via the NA service, Jadali was able to observe what staff members at thousands of companies were working on in near real-time. The NA website stated it collected data from millions of opt-in users. Jadali, along with journalists from Ars Technica and The Washington Post, interviewed impacted users, including individuals and major corporations.<a href="#cite_note-:0-1">[1]</a><a href="#cite_note-:1-2">[2]</a> According to the interviews, the impacted users did not consent to such collection.

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite id="CITEREFGoodin2019" class="citation web cs1">Goodin, Dan (2019-07-18). <a rel="nofollow" class="external text" href="https://arstechnica.com/information-technology/2019/07/dataspii-inside-the-debacle-that-dished-private-data-from-apple-tesla-blue-origin-and-4m-people/">"My browser, the spy: How extensions slurped up browsing histories from 4M users"</a>. Ars Technica. Retrieved 2020-07-28.</cite>

</li>

<li id="cite_note-:1-2">^ <a href="#cite_ref-:1_2-0">a</a> <a href="#cite_ref-:1_2-1">b</a> <cite id="CITEREFFowler2019" class="citation news cs1">Fowler, Geoffrey (2019-07-18). <a rel="nofollow" class="external text" href="https://www.washingtonpost.com/technology/2019/07/18/i-found-your-data-its-sale/">"Perspective: I found your data. It's for sale"</a>. Washington Post. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190718150650/https://www.washingtonpost.com/technology/2019/07/18/i-found-your-data-its-sale/">Archived</a> from the original on 2019-07-18. Retrieved 2020-07-28.</cite>

</li>

<li id="cite_note-3"><a href="#cite_ref-3">^</a> <cite id="CITEREFO'Flaherty2019" class="citation web cs1">O'Flaherty, Kate (2019-07-19). <a rel="nofollow" class="external text" href="https://www.forbes.com/sites/kateoflahertyuk/2019/07/19/data-leak-warning-issued-to-millions-of-google-chrome-and-firefox-users/">"Data Leak Warning Issued To Millions Of Google Chrome And Firefox Users"</a>. Forbes. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190719140153/https://www.forbes.com/sites/kateoflahertyuk/2019/07/19/data-leak-warning-issued-to-millions-of-google-chrome-and-firefox-users/">Archived</a> from the original on 2019-07-19. Retrieved 2020-07-28.</cite>

</li>

<li id="cite_note-4"><a href="#cite_ref-4">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.pcmag.com/news/browser-extensions-siphon-private-data-from-4m-users-then-leak-it">"Browser Extensions Siphon Private Data From 4M Users, Then Leak It"</a>. PCMAG. 2019-07-19. Retrieved 2025-01-28.</cite>

</li>

<li id="cite_note-:2-5">^ <a href="#cite_ref-:2_5-0">a</a> <a href="#cite_ref-:2_5-1">b</a> <cite id="CITEREFJadali2019" class="citation web cs1">Jadali, Sam (2019-07-18). <a rel="nofollow" class="external text" href="https://securitywithsam.com/2019/07/dataspii-leak-via-browser-extensions/">"DataSpii - A global catastrophic data leak via browser extensions"</a>. Security with Sam. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190718122051/https://securitywithsam.com/2019/07/dataspii-leak-via-browser-extensions/">Archived</a> from the original on 2019-07-18. Retrieved 2020-07-28.</cite>

</li>

<li id="cite_note-6"><a href="#cite_ref-6">^</a> <cite id="CITEREFSam_Jadali2019" class="citation web cs1">Sam Jadali [@sam_jadali] (5 December 2019). <a rel="nofollow" class="external text" href="https://x.com/sam_jadali/status/1202691665451864064">"Multibillion dollar cybersecurity companies leaked client data including government (Pentagon) and corporate data (BofA, AT&T, Novartis, Orange, and KP) in the #DataSpii browser extension leak. See attached for heavily redacted screenshot"</a> (<a href="Tweet_(social_media)" title="Tweet (social media)">Tweet</a>) – via <a href="Twitter" title="Twitter">Twitter</a>.</cite>

</li>

<li id="cite_note-7"><a href="#cite_ref-7">^</a> <cite id="CITEREFGoodin2019" class="citation web cs1">Goodin, Dan (2019-07-18). <a rel="nofollow" class="external text" href="https://arstechnica.com/information-technology/2019/07/dataspii-technical-deep-dive/">"More on DataSpii: How extensions hide their data grabs—and how they're discovered"</a>. Ars Technica. Retrieved 2020-07-28.</cite>

</li>

<li id="cite_note-8"><a href="#cite_ref-8">^</a> <cite id="CITEREFDreyfuss2019" class="citation magazine cs1">Dreyfuss, Emily (2019-07-20). <a rel="nofollow" class="external text" href="https://www.wired.com/story/browser-extensions-data-slack-passwords-security-roundup/">"Browser Extensions Scraped Data From Millions of People"</a>. Wired. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/1059-1028">1059-1028</a>. Retrieved 2020-07-28.</cite>

</li>

</ol></div></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-02-19" href="https://en.wikipedia.org/wiki/?title=DataSpii&oldid=1276549569">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>