One Of The World's Largest Web Tracking Companies Leaks Tons Of Personal Info From An Unsecured Server
from the so-happy-to-have-contributed-to-the-leak-by-using-the-internet dept
Advertisers want to know everything about you. So do sites that buy ad inventory and allow middlemen to let their trackers run free, tracing people from site to site, following them into their email inboxes, and tracking them across platforms and devices if need be.
BlueKai, owned by Oracle, deploys these pervasive trackers, sinking its hooks into a reported 1% of the world's internet traffic. BlueKai is the kind of clever no one really respects. It's more along the lines of "devious." But it is very, very effective.
BlueKai relies on vacuuming up a never-ending supply of data from a variety of sources to understand trends to deliver the most precise ads to a person’s interests.
[...]
BlueKai… uses more covert tactics like allowing websites to embed invisible pixel-sized images to collect information about you as soon as you open the page — hardware, operating system, browser and any information about the network connection.
[...]
BlueKai can also tie your mobile web browsing habits to your desktop activity, allowing it to follow you across the internet no matter which device you use.
All the information BlueKai grabs has to go somewhere so it can be packaged and sold to marketers. Considering how much data BlueKai is able to obtain about the average internet user, you'd think it would place a premium on keeping this data secure -- if not for the security of unsuspecting trackees, then to prevent its valuable stash from falling into a competitor's hands.
Unfortunately for a whole lot of internet users, BlueKai doesn't seem to believe this information -- or the people who generated it -- is worth protecting.
[F]or a time, that web tracking data was spilling out onto the open internet because a server was left unsecured and without a password, exposing billions of records for anyone to find.
Security researcher Anurag Sen found the database and reported his finding to Oracle through an intermediary — Roi Carthy, chief executive at cybersecurity firm Hudson Rock and former TechCrunch reporter.
TechCrunch reviewed the data shared by Sen and found names, home addresses, email addresses and other identifiable data in the database. The data also revealed sensitive users’ web browsing activity — from purchases to newsletter unsubscribes.
Oracle's response was to blame "two companies" for "not properly configuring their services." The two companies have not been named. Whoever these companies are, they collect data on a wide range of activities. TechCrunch examined the exposed data and found extensive records tied to individuals -- an astonishing pool of data that even indicated if a tracked person's device was in need of a software update. That's on top of the wealth of purchase and internet history that linked people to purchases, web searches, and other activity. Sitting in with everything else was personally identifiable info like addresses, phone numbers, and email addresses.
Very few people want all of this information in the hands of marketers. (BlueKai says it strips identifiable info before handing it over to its ad-serving customers.) And they definitely don't want it in the hands of people even more nefarious than ordained spyware pushers like BlueKai. The company has created a one-stop shop for phishers, stalkers, and identity thieves. And then it left the door unlocked for an undetermined amount of time.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: cookies, data leak, personal info, privacy, security, tracking
Companies: bluekai, oracle
Reader Comments
Subscribe: RSS
View by: Time | Thread
The two companies responsible: Oracle and the company they contracted with.
[ link to this | view in chronology ]
GDPR
It seems they are in serious breech of GDPR and other privacy laws. I foresee some fines incoming.
I just wished that when the fines are levied at the Oracle and the unnamed companies that they also fine the board-members or equivalent people.
[ link to this | view in chronology ]
We need a new law if you have a database with data on millions of users it should be encrypted and
Basic security procedures should be followed
in order to protect it from hackers
If personal data is exposed there should be large fines to make Companys take security seriously
[ link to this | view in chronology ]
Re:
Considering our government's current war on encryption, I highly doubt we will see anything that responsibile from them anytime soon.
[ link to this | view in chronology ]
The investigation will likely find that the 'Two Companies' have few assets subject to tort recovery and the contracts between the companies and Oracle and others clearly put all financial responsibility on the 'Two Companies'.
Wouldn't be surprised if said contracts are being printed off now and back dated by a fully activated Oracle legal staff.
[ link to this | view in chronology ]
Is there any reason we should believe this?
And we all know that even meta-data can be personally identifiable, and can be used to create an extremely detailed individual profile / database / dossier. Encryption as the default, end-to-end, everywhere, for everything, (DNS too) with a good dose of 'trash' thrown in to inhibit traffic pattern analysis, really needs to become standard procedure.
[ link to this | view in chronology ]
Please understand..
There have been MILLIONS of internet breakins.
And a bunch of them are with Clinics and hospitals..
Not to mention a Major Credit corp and over 200 million..
Then SONY in S. America, had a major server breakin, in the order of TERABYTES.
ORACLE=JAVA and recently helped ZOOM.
Who knows WHY we want abit of privacy, and for some reason we cant have it.?
There is only 1 PRIVATE system out there, thats hard to get to. MEDICAL. And why doctors DONT share info, unless you say they can.
Its about time, we make a choice. We can dump all our info, even sell it, and get spammed all to hell...but what happens.
Credit cards need better ID
Drivers licence needs better ID
Everything including your bank needs Better ID..
Every corp wants MORE ID.
Facial ID anyone? Fake it..ok..
WHO WANTS A CHIP?? oops...I think that can be faked also givien about 6 months.
HOW the heck do you think they will ID all of us?
Its kinda impossible to find something foolproof. but using 2-3 formats can make it harder and time consuming to do any of it.
Get those Tin foil hats out, we are going to have a sale.
[ link to this | view in chronology ]
Re: Please understand..
The problem is the constant data collection and a demand for unique tracking of everyone.
In simple terms, unique ID of everyone is impossible to obtain. Eventually, a bad actor will copy all of the unique portions and make it impossible to determine a fake. Then you need more unique data. Rinse, lather, and repeat. Even if you rely on a third party, let's say the government, to handle IDs, the same situation applies to them.
In reality, most of this collection should be banned. A store has no justifiable reason to know what your personal interests are. Sorry, those personalized recommendations do not outweigh the need to be able to reliably ID the user of a bank account, or the unconscious person laying on a stretcher in the emergency room. Yes, that data should be untouchable. Why? Because that information is used to create passwords / phrases used to ID people. That information helps to map the person's knowledge and what "random" bits that they have to pull from for creating secure data / identifiers. Essentially, /dev/urandom on a human is mostly filled by the contents of /var/db/*. Especially when anything /dev/urandom generates needs to be rememberable without aid.
The same can be said for employers. The only thing they need is a name and national ID number to submit their taxes with. They don't need access to your phone or social media accounts. If they are worried about leaks or bad PR, maybe they shouldn't be direct hiring people off of the street into sensitive positions. Maybe they should build trust with their employees instead of considering them as disposable at best and a threat at worst by default. Take the time build a relationship with them before trusting them with sensitive materials. And of course, if even your lowest on-the-corporate-ladder employees are a risk, maybe you need to clean up your own trenches if you don't want people to complain about the conditions.
The world was able to get by for millennia without ubiquitous constant surveillance. Just because you can creep on others doesn't mean you should.
[ link to this | view in chronology ]
Re: Re: Please understand..
The bartender knows what type of beer I like. Distinguish.
[ link to this | view in chronology ]
Anti-Data-Theft law
Wow. Perhaps what is needed, is a law that allows users to Opt-Out of all internet advertising, altogether. Many of us simply have no use for targeted ads, since we simply do not shop-till-we-drop simply because we see an advertisement for something we like. Call it the Internet User's Rights Law. (I-URL) Then, upon discovering our data in an advertiser, or data-scooper archive, we could get recompense via law.
Yeah, I know. Never happen. Citizens don't have such rights, and likely never will. Too damn bad that.
[ link to this | view in chronology ]
Re: Anti-Data-Theft law
lets have fun..
IF the 3rd party adverts wouldnt insert CRAP on my computer, and Just allow a site count, and referral link...I WOULD NOT MIND.
But they love to put things on your computer to track IF/WHERE you have seen their adverts.
Not long enough ago, I would scan every day or have a customer have problems and scan the machine, and you would find 60-200 advert trackers. Each taking TIME off of the CPU. A good machine would run like a 386/25mhz..
NOW there is a trick to this. When you install a tracker or other bot, you have it use the net 1 time, on load up, BEFORE windows is fully loaded. And no one notices it.
What hurt those agencies was HIRING OUT to a programmer to do the job, and he Inserted his OWN crap. Turn your machine into a Zombie mailer or Just Virus or remote access.. Even Windows had 1, in media player, it was for testing, and sent back a list of all recording played...BUT NO AV FOUND IT.... fun isnt this.
[ link to this | view in chronology ]
May not be Blue Kai
The data breach is likely related to another (or multiple) Oracle Marketing Cloud product such as CX Unity that also holds Blue Kai data. https://www.oracle.com/marketingcloud/ https://www.oracle.com/applications/customer-experience/platform/cx-unity.html
From what I can tell from past experience with it, Blue Kai holds pseudonymous information and wouldn't hold name, address, or email address. But CX Unity would. Either way, Oracle f'd up by not requiring a password be declared during customer set-up and it's customers failed even worse by not properly protecting their customers' data.
[ link to this | view in chronology ]