In a recent development, Google has opted for a settlement in a $5 billion privacy lawsuit accusing the tech giant of intruding on individuals utilizing the “incognito” mode in its Chrome browser.
This legal action, initiated in 2020, contended that Google deceived users by leading them to believe that their internet activities would remain untracked while in incognito mode.
The lawsuit further alleged that Google’s advertising technologies and other methodologies persisted in logging users’ site visits and activities, contradicting the concept of a truly “private” browsing experience.
Deceptive Practices
The crux of the class-action lawsuit rested on the assertion that users were misled about the efficacy of incognito mode in shielding their online behaviors.
The plaintiffs argued that Google’s activities resulted in an “unaccountable trove of information” concerning users who believed they had taken adequate measures to safeguard their privacy.
Path to Resolution
The settlement, which was reached recently, is pending approval from a federal judge. Although the specific payment terms were not disclosed, the initial lawsuit sought a substantial $5 billion for affected users.
Legal representatives for the plaintiffs anticipate presenting the final settlement agreement to the court by February 24.
Awaiting Judicial Approval
As the resolution awaits judicial approval, Google has refrained from immediate commentary on the settlement. The outcome of this legal matter will undoubtedly have implications for the ongoing discourse surrounding user privacy in the digital age.
Apple System-on-a-Chip Exploitation
Russian cybersecurity firm Kaspersky, found a hardware feature within Apple’s system-on-a-chip (SoC) in a targeted attack, allowing it to compromise protections of the iPhones of several high-profile Kaspersky employees earlier this year.
The incident, termed ‘Operation Triangulation,’ exposed multiple zero-day vulnerabilities in iOS, enabling the execution of malicious code and the installation of a stealthy spyware implant named TriangleDB.
Exploitation Chain
Operation Triangulation utilized a sophisticated infection chain that exploited iOS zero-day vulnerabilities to execute code and deploy TriangleDB spyware without user interaction.
Kaspersky detailed that malicious iMessage attachments were employed to exploit a remote code execution (RCE) zero-day, identified as CVE-2023-32434.
Additionally, two other zero-day flaws were exploited in the attack, including an RCE issue in Apple’s ADJUST TrueType font instruction (CVE-2023-41990) and a bypass of hardware-based security protections (CVE-2023-38606).
Unique Vulnerability: CVE-2023-38606
Kaspersky emphasized the significance of CVE-2023-38606, describing it as the most intriguing aspect of Operation Triangulation.
This vulnerability allowed the attackers to utilize hardware memory-mapped I/O (MMIO) registers to bypass the Page Protection Layer (PPL) through a JavaScript exploit.
What Should We Expect Now?
The Google privacy lawsuit and subsequent settlement highlight the balance between user expectations, company disclosures, and the importance of online privacy.
The outcome of this case may catalyze increased scrutiny and awareness regarding data tracking practices employed by technology companies, emphasizing the ongoing need for transparency and ethical standards.
On the other hand, Kaspersky has raised numerous unanswered questions regarding how the attackers acquired knowledge of this unknown hardware feature and its original purpose.
The firm expressed uncertainty about whether Apple developed the feature or if it possibly originated from a third-party component such as ARM CoreSight.
Marrium Akhtar
January 10, 2024
4 months ago
