H&R Block Certificate Risk and Tracking Pixel Privacy Findings

Summary

Security Now examines a reported H&R Block certificate flaw, a cyberattack disrupting Intoxilock services, and research into personal-data collection by Meta and TikTok tracking pixels.

Key points

• A researcher reported that H&R Block Business 2025 installs a trusted root certificate and includes its private key in a DLL; the certificate reportedly remains after uninstalling the software.
• The researcher demonstrated TLS traffic manipulation using the key and DNS spoofing. H&R Block reportedly closed the disclosure as outside its program scope.
• Steve Gibson proposed unique, short-lived and constrained certificates for each installation, with the root private key deleted after use.
• A cyberattack disrupted Intoxilock's breathalyzer calibration service, potentially preventing some drivers from using their vehicles. The company subsequently reported that systems were restored.
• J. Scrambler reported that Meta and TikTok pixels collected personal and checkout data on analyzed websites, sometimes before consent choices were applied.
• The researchers recommended auditing pixel configurations and continuously monitoring third-party scripts for changes in data collection.