Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
US Postal Service Suspends Telecommuting Following Massive Data Breach
Newest First  |  Oldest First  |  Threaded View
skandragon
100%
0%
skandragon,
User Rank: Apprentice
11/13/2014 | 12:48:24 PM
They leaked my email address a long time ago...
I give every company or entity I work with a new, unique-to-them address.  Somehow, Home Depot managed to get the one I gave only to the USPS.  This happend first on Oct 3rd, where Home Depot contacted me on that USPS-specific address.

USPS told me at the time they did not have a breach, nor did they sell or rent addresses.  Home depot says they don't buy them.  I am pretty sure both are lying.  When they cannot tell the truth even after the facts are known, what's the point in a privacy policy or a statement about how they use email addresses at all?
savoiadilucania
100%
0%
savoiadilucania,
User Rank: Moderator
11/12/2014 | 1:40:30 PM
Fascinating
"The intrusion is limited in scope and all operations of the Postal Service are functioning normally."

In my experience this does not align with a decision to take down full VPN access. This sounds like something persistent and pervasive...
jastroff
50%
50%
jastroff,
User Rank: Strategist
11/12/2014 | 11:01:03 AM
Re: Timing
Agree that notification is a difficultly timed business. But I didn't even see this on the news (doesn't mean it wasn't there, but it didn't make the splash that let's say Target of Home Depot did) -- it seems well hidden for such an important breach, and the issues the USPS had
Bprince
50%
50%
Bprince,
User Rank: Ninja
11/12/2014 | 8:28:12 AM
Timing
Notification of breaches can be tricky. If you come out too soon, you may not have all the facts. Wait too long, and you may impair the ability of people to protect themselves from fraud. I think the USPS needs to explain the delay. 

BP


Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32693
PUBLISHED: 2021-06-17
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the fir...
CVE-2021-32424
PUBLISHED: 2021-06-17
In TrendNet TW100-S4W1CA 2.3.32, due to a lack of proper session controls, a threat actor could make unauthorized changes to an affected router via a specially crafted web page. If an authenticated user were to interact with a malicious web page it could allow for a complete takeover of the router.
CVE-2021-32426
PUBLISHED: 2021-06-17
In TrendNet TW100-S4W1CA 2.3.32, it is possible to inject arbitrary JavaScript into the router's web interface via the "echo" command.
CVE-2021-32694
PUBLISHED: 2021-06-17
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1.
CVE-2021-32695
PUBLISHED: 2021-06-17
Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shared preferences of the Nextcloud Android application. This required user-interaction as a victim had to initiate the sharing flow and choose t...