Day: April 26, 2018

A leaky database discovered online contains a wealth of sensitive data belonging to thousands of investors in Bezop cryptocurrency, including photocopies their driver’s licenses and passports, according to a report from Kromtech Security.

Kromtech announced on Wednesday that Bezop, which offers its own cryptocurrency “tokens” in addition to… some sort of blockchain-based e-commerce app, left a MongoDB database wholly unsecured, exposing “full names, addresses, email addresses, encrypted passwords, wallet information, along with links to scanned passports, driver’s licenses, and other IDs for over 25,000 investors.”

Among the advisors named on the organization’s website is John McAfee, the former security software tycoon turned fugitive turned paid cryptocurrency hustler. (I am Jack’s utter lack of surprise.)

Earlier this year, McAfee revealed that he charges up to $105,000 to promote initial coin offerings (ICOs) on his Twitter account, which at time of writing boasts roughly 821,000 followers. He also announced in March that he was opening up his own “hackproof” crypto-security firm—whatever the hell that is.

“I have become an advisor to bezop.io,” McAfee wrote in a testimonial featured on Bezop’s website. “I recommended them recently and, as an early investor in their ICO, I want to make sure they succeed in implementation.”

Bezop was not immediately reached for comment.

In a statement to Threatpost, the organization’s CTO, Deryck Jones, said a notification was sent out earlier this year warning people that the Bezop had been targeted by a DDoS attack and also of “security holes exposing that data.” (Threatpost noted it was unsure if Jones was actually referring to the passports and other information uncovered by Kromtech.)

On Medium yesterday, Bezop disclosed that McAfee was paid to promote its cryptocurrency and said investors were notified about the breach on January 8. Kromtech, meanwhile, says the investors’ data was publicly accessible as late as March 30.

Bezop launched a “bounty” program in early January, according to Kromtech, around the time of its ICO. One of the tables in the exposed Bezop database, which researchers said was not protected by a password and could be accessed by virtually anyone online, was called “Bounty,” suggesting the data it contains may belong to the people who participated in the program.

“It does not seem to be a very good start for a company such as this to place personal information of anyone on the Internet and open to the public, especially it’s early investors,” Kromtech said.

“In fact, it’s a little difficult to grasp how it could happen, even if by mistake,” Kromtech added. “Given the changes to MongoDB, it would have to have been deliberately configured to be public, a configuration which should not even be risked internally.”

Google has partnered with the Drug Enforcement Administration to mark locations where people can safely dispose of excess prescription drugs on its Maps platform, the company announced in a blog post on Wednesday.

The search giant wrote that prescription drugs are a driver of opioid addiction and that the “majority of abused prescription drugs are obtained from family or friends, often from a home medicine cabinet”—something that is backed by medical surveys. According to Google, they partnered with the DEA to roll out the feature in advance of April 28th’s National Prescription Drug Take Back Day, which is intended to encourage people to take leftover medication to disposal sites:

Using Google Maps API, our team worked with the DEA to create a locator tool for the National Prescription Drug Take Back Day this Saturday, April 28. The locator tool can help anyone find a place near them to safely dispose of leftover prescription medications. Click on the image below to access the locator, and enter an address or zip code to find nearby Take Back Day events this Saturday and help fight the opioid epidemic.

Here’s a GIF of the feature in action, courtesy of Google:

Opioid deaths have skyrocketed across the country in recent years, with recent federal data showing that 63,632 people died of drug overdoses in 2016, with 42,249 of them involving at least one opioid. Synthetic opioids other than methadone, which tend to be far more powerful than non-sythetic ones, caused 10,375 deaths that year.

Since research shows many opioid users start with prescription drugs often prescribed by a doctor, aiding voluntary disposal of leftover pain pills or other prescription drugs before the temptation to use them strikes sounds helpful. It’s also probably good for the environment, seeing as flushing pharmaceuticals into waterways is a major source of pollution (though the Federal Drug Administration advises that scientists believe this is mostly a result of drugs that have passed through the body).

So this new Google Maps feature is innocuous enough! But it’s worth noting that despite vague commitment from Donald Trump’s White House to solve the opioid crisis, federal law enforcement agencies like the DEA have doubled down on failed “tough-on-crime” policies at the same time most Americans have realized that a public health approach is better. The president himself is reportedly in favor of anti-drug scare tactics of the Reefer Madness variety as well as executing drug dealers, so there’s that too.

[Google]