Netflix May Stop Allowing Users To Share Their Passwords

Do you have a Netflix account?

If so, you know how awesome the service is.  Intuitive and easy to use, and of special interest, easy to share.

In fact, password sharing among family and friends is so common that it’s even openly discussed on discussion forums around the web.

Unfortunately, it has become so commonplace that Netflix has begun making noises about finding ways of limiting the practice.  Greg Peters, Netflix’s Chief Product Officer, had this to say on the topic:

“We continue to monitor it.  We’ll continue to look at the situation and we’ll see those consumer-friendly ways to push on the edge of that, but we’ve got no big plans at this point in time in terms of doing something different there.”

As we said, this is not language that raises alarm bells.  This is the earliest stages of rumbling from a company that’s fundamentally dissatisfied with the idea that they’re losing money at the margins. At least some of the people enjoying their content are borrowing a paying customer’s password, and a portion of those would probably sign up for their own accounts if the company pressed the issue and they had to.

No doubt, based on the statement above, the day will eventually come when Netflix starts taking a harder look at the practice of sharing accounts and begins punishing users who break their password sharing rules. It seems clear that that day isn’t upon us yet.

All that to say, if you’re currently in the practice of letting your brother in law or girlfriend borrow your account access to watch movies, you can continue to do that, at least for the foreseeable future.  Even when the day comes that the company clamps down on that kind of thing, there are already several tools, like the Netflix Party Chrome Extension that allow sharing in a different form.

Malware Takes Down Services At Popular Billing Company

Billtust is major player in the US financial services sector that provides a variety of billing and payment processing services for some of the biggest financial institutions in the nation. On October 17th, they suffered a malware attack that brought all of their services to a grinding halt.

Unfortunately, the company did not notify any of their customers about the incident.

Instead, one of their customers, Wittichen Supply Company, noticed issues with Billtrust’s services and posted information about the outage on their company’s website. That prompted Billtrust to reach out to them and provide additional information.

Wittichen’s notice reads, in part, as follows:

“We were notified late yesterday that BillTrust (our third party vendor for customer invoice and online bill payment) was the subject of a Malware attack.  BillTrust is working with federal law enforcement and cyber security firms to investigate and remediate the attack.”

BillTrust went on to assure Wittichen Supply Company that none of its customers’ data was compromised and that they were working around the clock to restore services. Wittichen’s announcement finally did prompt the company to provide some additional information, which it made available to its customers.

On October 18th, Billtrust posted the following overview of their services and their operational status:

  • Billtrust Credit (former Credit2B) – up and operational
  • Billtrust eCommerce (Second Phase) – up and operational
  • Billtrust Virtual Card Capture – scheduled to be up and running on Saturday, October 19 with a plan to work through the weekend to begin catching up on back log.
  • Billtrust Cash Application – Over the next 12-24 hours, we intend to bring Cash Application customers live starting with processing of lockbox and open balance files.
  • Billtrust Billing & Payments – Billing and Payment websites will be turned on this evening followed by FTP connectivity. We expect card payment processing to resume this evening and ACH processing to resume on Monday, October 21 but will update you if anything changes.
  • Billtrust VueBill – Please contact your account representatives for specific details.

It’s good information.  It’s just a pity that the company didn’t see fit to start providing it until they were forced to do so by one of their own customers.  In any case, if you use Billtrust, be aware.  No further details about the attack have been forthcoming to this point.

Pitney Bowes Company Recently Hit By Ransomware

If you’re a business owner, you probably utilize at least a few of the services Pitney Bowes offers.  They maintain a global shipping, mailing, e-commerce and financial services empire that touches just about every country on the planet.

The company has more than 1.5 million customers and service 90 percent of the companies on the Fortune 500 list.

Unfortunately, they’ve also recently fallen victim to a ransomware attack that has left the company with several of their key systems encrypted. That has resulted in a partial outage that impacted customer access to some of their services.

Other than announcing the reason behind the partial outage, the company has stressed that at this time, they see no evidence that any customer or employee data was improperly accessed.  They also assured their customers that their Enterprise Outage Response Team was on the case and that they are currently working with third-party security experts to help resolve the issue.

At this time, if you have an account with Pitney Bowes and utilize their mailing system, you won’t be able to access your account data, refill postage or upload your transactions to the company’s server. The company notes that it is making progress on restoring the ability to add postage to your machines and should have that portion of their service restored in the very near future.

They also stress that if you currently have postage credits in the machine you’re using, you’ll be able to continue printing postage just fine.  It’s simply that refilling it when you run out remains an issue.

In addition to that, SendPro Online for both the UK and Canada is also currently down, and you can’t currently access your account on the company’s web store.  Unfortunately, the company has not provided an ETA to its customers on when full functionality might be restored. At this time, we have no information about the type of ransomware used in the attack, nor the size of the ransom demanded.

American Express Employee Compromises Customer Information

American Express has been quietly contacting some of its customers with a tersely worded communication that reads, in part, as follows:

“It was brought to our attention that personal information related to your American Express Card account listed above, may have been wrongfully accessed by one of our employees in an attempt to conduct fraudulent activity, including potentially opening accounts at other financial institutions.  In response, we immediately launched an investigation and are fully cooperating with law enforcement agencies to further their investigation.”

There are a couple of noteworthy things about this.  First, it’s American Express, one of the Titans of the Financial industry.  While it’s true that AMEX has been compromised before and certainly will be in the future, it underscores the fact that it doesn’t matter who you are or how big your company, you are not safe.

Second, it highlights a problem that seldom gets mentioned when we talk about data breaches.  This one came from the inside.

Your employees are simultaneously your greatest asset and your company’s biggest point of weakness, as this incident reveals.  It doesn’t matter how much you spend on information security. An employee working from the inside can circumvent every security measure you have in place.

Worse, there are no good solutions to this issue.  Obviously, your employees need access to data in order to do the job you hired them to do, and often that data is of a sensitive nature.  Even if your hiring practices are quite robust and do a generally good job of weeding out potentially weak links in the chain, there’s simply no good way to guarantee that any employee you take a chance on hiring won’t ultimately be the one to betray your trust and the trust of your customers.  That’s terrifying, but that’s the reality.

 

Vimeo Could Have Collected Biometric Data Without Consent

The popular video site Vimeo now finds itself in hot water and are facing a lawsuit for allegedly violating the Illinois Biometrics Information Privacy Act.  The act requires all private companies collecting biometric information to maintain a publicly available, written policy that explains their practices concerning this type of information.  It also includes guidelines relating to the retention and destruction of such information.

According to the lawsuit filed:

“Vimeo is actively collecting, storing and using–without providing notice, obtaining informed written consent or publishing data retention policies–the biometrics of thousands of unwitting individuals throughout the country whose faces appear in photographs and/or videos uploaded to the Magisto “smart video editor” application in Illinois. Each face template that Vimeo extracts is unique to a particular individual in the same way that a fingerprint or voiceprint uniquely identifies one and only one person.”

The lawsuit is being brought forth by Illinois resident Bradley Acaley, who downloaded the Magisto app in 2017.  He purchased an annual subscription for $120, uploaded several photos and videos of himself and then could no longer access them after his subscription ended.

A Vimeo spokesperson had this to say about the recent filing:

“The lawsuit is based upon a fundamental misunderstanding of how the Magisto video creation app works.  To help customers create better videos faster, Magisto uses machine learning technology to help identify objects within video frames.  Determining whether an area represents a human face or a volleyball does not equate to “facial recognition,” and Magisto neither collects nor retains any facial information capable of recognizing an individual.  We look forward to having an opportunity to clear this up in court.”

It’s an interesting case and its outcome will no doubt have ramifications and ripple effects that extend far beyond Vimeo.  Stay tuned.