News of the Cyber World

[kyonides]

Elon Musk says Twitter will charge $8 for blue tick

Twitter Inc will charge $8 for its Blue service, which includes its sought-after "verified" badge according to Twitter's new boss Elon Musk.

"Twitter's current lords & peasants system for who has or doesn't have a blue checkmark is bullshit. Power to the people! Blue for $8/month," Musk said in a tweet, adding that the price will be adjusted by "country proportionate to purchasing power parity."

Musk said blue-tick subscribers would get priority in replies, mentions and searches, and be able to post longer videos and audios, while dealing with half as many ads.

He also offered subscribers a paywall bypass from "publishers willing to work with us."
...
Amid speculations that Twitter may soon start charging verified users a monthly fee of $20 for blue ticks, bestselling author Stephen King tweeted: "If that gets instituted, I'm gone like Enron."

Separately, S&P Global Ratings downgraded Twitter to B- on "significant" debt increase following the acquisition.

Experian tool exposed partial Social Security numbers, putting customers at risk

An Experian product that allows organizations to verify customers’ identity could be exploited to expose partial Social Security numbers, a researcher found through testing several organizations that use the product.

The researcher, who asked to be identified only by the online handle Lucky225, first detailed the security issue in a September Medium post after finding it when trying to register for the Pacific Gas and Electric Company. Lucky225 contacted CyberScoop after identifying three additional clients using the same function — two healthcare companies and a state health agency’s vaccination verification system.

The problem with making it easy for bad actors to access a partial SSN is that those four digits provide a gateway for attackers to take over other services and devices.

“It is essentially the same as having your password,” Lucky225 explained.

For instance, attackers could use them to convince a phone company to port a victim’s cellphone number to a new device. The technique, known as SIM Swapping, allows cybercriminals to bypass two-factor authentication and gain access to everything from a target’s Twitter account to their bitcoin wallets.

PG&E removed the function in early September after being contacted by Lucky225.
...
Experian takes data from credit histories and public records and drafts a set of multiple-choice questions that hypothetically only the real person should be able to answer.

However, getting those questions to populate — and therefore the partial SSN — only took a name and current or former address. Lucky225 recreated his results experimenting with his own information and information from friends. In some cases, the form also asked for an alternate ID or account number but did not check if that number was authentic.

Lucky225 contacted Experian with concerns about the Social Security Number question in September but after an initial conversation, the company stopped responding. Experian did not respond to multiple requests for comment from CyberScoop.