This week, online security has seen both ups and downs in the headlines. Online auction website, eBay, sent out a news release announcing that user passwords and personal information had been compromised by a cyber attack. On the other side of the coin, Facebook announced that in it’s latest round of updates, it has changed its default post settings to protect users from oversharing personal information.

Gordon Kelly of Forbes reports on the eBay attack saying, “the origin of the breach comes from hackers compromising a small number of employee log-in credentials, which gave access to eBay’s corporate network. eBay says it is working with law enforcement and leading security experts to aggressively investigate the matter.” eBay has asked its users to protect themselves by changing their password information.

Tony Bradley of PCWorld worries that the eBay breach will result in social engineering schemes and cautions readers to be on alert to potential danger from malicious actors attempting to take advantage of the situation through phishing schemes. Bradley comments, “The attackers can use information like your phone number, email address, and mailing address for targeted phishing campaigns… You can’t trust any emails or phone calls you receive. You can’t even trust snail mail. Any communication you receive should be treated with skepticism, and you should contact the company in question yourself to make sure it’s legitimate.”

Josh Constine of TechCrunch reports on the latest Facebook updates, saying, “After years of putting new users at risk of oversharing by defaulting the visibility of their status updates and photos to public, Facebook is switching the default to ‘friends’. Constine comments that this change will hopefully help protect users from accidentally oversharing information that would put them at risk online.

Vindu Goel of the New York Times also explores the latest Facebook update, which includes a feature to make sure users are properly updating their privacy settings. Goel writes, “the service will walk users through the privacy settings for their status updates, remind them of the applications that have permission to use their Facebook data, and review the privacy settings for some of the most private information on their profiles, such as their hometown, employer, email address, phone number and birth date.” Goel quotes Mark Zuckerberg on the matter saying, “what we really want is to enable people to share what they want.”

Will a simple password change be enough to protect eBay users or should alternative measures be taken? Will the latest round of Facebook updates improve online security and privacy? Let us know what you think on Twitter and Facebook, and be sure to check out our Tumblr for the latest industry news stories.

This week, The Retail Industry Leaders Association (RILA) announced the launch of an intelligence center where retailers can exchange information about data breaches and threats to help protect against cybercrimes.

According to the Associated Press, RILA’s president Sandy Kennedy said that retailers have a common goal: to protect their business against cyber threats.

“It’s really in everyone’s interest, every retailer’s interest, to protect information against cybercrime,” Kennedy said. “Criminals are getting more and more sophisticated. We’re looking at how we can deal with this long term.”

The New York Times and ZDNet reports that participating retailers include American Eagle Outfitters, Gap, J.C. Penny, Lowe’s, Safeway, VF Corporation, Walgreens, Nike, Lowe’s and Target, “which was hit with a large data breach at the height of last year’s holiday shopping season.”

ZDNet’s Natalie Gagliordi said the center will allow retailers to share threat information with one another, as well as “anonymized information” with the government through a cyber analyst and technician at the National Cyber Forensics and Training Alliance.

“The technicians and analysts are on the lookout for real-time cyber threats such as new strains of malware, activity on underground forums and potential software vulnerabilities, which they say can be translated into actionable insights,” Gagliordi writes.

Will this center help retailers protect against future cyber threats? What do you think about retailers banding together to fight cyber crime? Let us know what you think on Twitter and Facebook, and be sure to check out our Tumblr for the latest industry news stories.

Late last week, it was reported that a flaw in an online security technology could likely expose social media users personal information to malicious actors.

Jodi Mardesich of ReadWrite, comments, “It’s not the next Heartbleed, but a security flaw in social-login services gives you one more thing to watch out for in apps and on the Web.” Mardesich explains the issue by saying, “the vulnerability stems from a flaw in OAuth 2.0 and OpenID technology that lets you use your login from Facebook, Google, or Amazon (among others) to access other sites and services. Because of the flaw, an attacker can trick a user into thinking he or she is signing in via Facebook or Google and then redirect them to a malicious website. From there, depending on the level of access granted, it can expose your personal information, your contacts, your friends list, or in the case of Google Apps, stored data.” These different social logins offer connectivity to various services quickly and conveniently, but this shortcut in security comes with a price.

While this vulnerability exposes the potential actions of a malicious actor, it also sheds light on the security weaknesses in development and integration with social media sites. Mardesich expands on these weaknesses with this example: “Facebook, for instance, recommends developers use a whitelist that would effectively close the OAuth loophole by limiting redirections to safe and secure URLs. But Facebook doesn’t require a whitelist, and as a result, many developers don’t use one.”

What actions do social media sites need to take to improve security in development and prevent issues like this vulnerability? What precautions should individuals take to ensure the security of their information? Let us know what you think on Twitter and Facebook, and be sure to check out our Tumblr for the latest industry news stories.