Privacy, Security Archive

The CIA campaign to steal Apple’s secrets

Thom Holwerda 2015-03-10 Privacy, Security 19 Comments

Researchers working with the Central Intelligence Agency have conducted a multi-year, sustained effort to break the security of Apple's iPhones and iPads, according to top-secret documents obtained by The Intercept.

The security researchers presented their latest tactics and achievements at a secret annual gathering, called the "Jamboree," where attendees discussed strategies for exploiting security flaws in household and commercial electronics. The conferences have spanned nearly a decade, with the first CIA-sponsored meeting taking place a year before the first iPhone was released.

Outrage something something not surprised exclamation point.

The great SIM heist

Thom Holwerda 2015-02-19 Privacy, Security 65 Comments

American and British spies hacked into the internal computer network of the largest manufacturer of SIM cards in the world, stealing encryption keys used to protect the privacy of cellphone communications across the globe, according to top-secret documents provided to The Intercept by National Security Agency whistleblower Edward Snowden.

The hack was perpetrated by a joint unit consisting of operatives from the NSA and its British counterpart Government Communications Headquarters, or GCHQ. The breach, detailed in a secret 2010 GCHQ document, gave the surveillance agencies the potential to secretly monitor a large portion of the world’s cellular communications, including both voice and data.

The company targeted by the intelligence agencies, Gemalto, is a multinational firm incorporated in the Netherlands that makes the chips used in mobile phones and next-generation credit cards. Among its clients are AT&T, T-Mobile, Verizon, Sprint and some 450 wireless network providers around the world. The company operates in 85 countries and has more than 40 manufacturing facilities. One of its three global headquarters is in Austin, Texas and it has a large factory in Pennsylvania.

The Americans and British hacking into a Dutch company's private network to steal information so they can spy on pretty much everyone. And we call them our "allies". This is way, way worse than whatever the North-Koreans supposedly did to Sony.

In a just world, the people responsible for this act of aggression would be dragged to The Hague to face justice. Alas - we do not live in a just world. My own Dutch government will sweep this under the rug after some fake posturing for the electorate, and that's that.

Russian researchers expose breakthrough in US spying program

Submitted by zhengiszen 2015-02-18 Privacy, Security 47 Comments

The U.S. National Security Agency has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba and other top manufacturers, giving the agency the means to eavesdrop on the majority of the world's computers, according to cyber researchers and former operatives.

That long-sought and closely guarded ability was part of a cluster of spying programs discovered by Kaspersky Lab, the Moscow-based security software maker that has exposed a series of Western cyberespionage operations.

Google reveals third unpatched 90-day Windows vulnerability

Submitted by Alfman 2015-01-19 Privacy, Security 46 Comments

Microsoft has heavily criticized Google and its 90-days security disclosure policy after the firm publicly revealed two zero-day vulnerabilities in Microsoft's Windows 8.1 operating system one after one just days before Microsoft planned to issue a patch to kill the bugs. But, seemingly Google don't give a damn thought.

Once again, Google has publicly disclosed a new serious vulnerability in Windows 7 and Windows 8.1 before Microsoft has been able to produce a patch, leaving users of both the operating systems exposed to hackers until next month, when the company plans to deliver a fix.

First, this article makes the usual mistake of calling these vulnerabilities "zero day". They are not zero day. They are 90 day. A huge difference that changes the entire context of the story. Microsoft gets 90 days - three months - to address these issues. I do not see why Google has to account for Microsoft's inflexible security policies which leave users in the lurch.

Second, note that Google also disclosed two OS X vulnerabilities alongside the Windows one. Nobody seems to be talking about those.

Third, Google, how about addressing your own security problems.

How Verizon and Turn defeat browser privacy protections

Thom Holwerda 2015-01-15 Privacy, Security 19 Comments

Verizon advertising partner Turn has been caught using Verizon Wireless's UIDH tracking header to resurrect deleted tracking cookies and share them with dozens of major websites and ad networks, forming a vast web of non-consensual online tracking. Explosive research from Stanford security expert Jonathan Mayer shows that, as we warned in November, Verizon's UIDH header is being used as an undeletable perma-cookie that makes it impossible for customers to meaningfully control their online privacy.

A virtually unchecked and unbound company with near-monopoly status in many US areas doing something scummy? I am so surprised.

Thunderstrike: firmware vulnerability in Apple’s EFI

Thom Holwerda 2015-01-01 Privacy, Security 20 Comments

This is an annotated version of my 31C3 talk on Thunderstrike, a significant firmware vulnerability in Apple's EFI firmware that allows untrusted code to be written to the boot ROM and can resist attempts to remove it.

Very detailed write-up on this remarkable vulnerability.

Flaw discovered that could let anyone listen to your cell calls

Guest post by twitterfire 2014-12-20 Privacy, Security 15 Comments

German researchers have discovered security flaws that could let hackers, spies and criminals listen to private phone calls and intercept text messages on a potentially massive scale - even when cellular networks are using the most advanced encryption now available.

The flaws, to be reported at a hacker conference in Hamburg this month, are the latest evidence of widespread insecurity on SS7, the global network that allows the world's cellular carriers to route calls, texts and other services to each other. Experts say it's increasingly clear that SS7, first designed in the 1980s, is riddled with serious vulnerabilities that undermine the privacy of the world’s billions of cellular customers.

Home Network Insecurity

Howard Fosdick 2014-11-17 Privacy, Security 27 Comments

Is your home wireless network secure? On a drive about town, I noticed that about one fifth of home routers are completely open and perhaps half are under-secured.

Used to be, this was because home users didn't know how to configure their routers. But now, Comcast is turning home networks into public hotspots unless customers -- few of whom even know about this -- specifically opt out. This article discusses the problems with this.

U.S. courts may hold you responsible if someone uses your wireless network -- without your knowledge or permission -- to illegally download music, movies, or software. People have even been raided by SWAT teams and convicted for downloading child pornography.

Is Comcast's project a bold move towards free wi-fi everywhere? Or is it a security outrage?

Meanwhile, here's a simple tutorial on how to secure your home wireless network.

DenyHost adds support for PF firewall

Guest post by jessesmith 2014-11-10 Privacy, Security 5 Comments

One common method attackers use when attempting to compromise a server is brute forcing login credentials. Given enough time, automated tools can guess a person's username and password, granting the attacker access to an unprotected server. To counter these sorts of attacks, where passwords are guessed by trial and error, several tools have been created. Utilities such as Fail2Ban and DenyHost monitor login attempts and automatically block the computers performing these types of attacks.

Last week the DenyHost project added a feature which allows the utility to block attacks by using the PF firewall. PF is typically used on the OpenBSD and FreeBSD operating systems to block or forward network traffic. The project's website reports:

DenyHost 2.9 adds one new feature, the ability to work with the PF packet filter, popular on BSD systems such as FreeBSD, OpenBSD, NetBSD, PC-BSD and TrueOS. The DenyHost daemon will now work with existing PF tables in real time, allowing administrators to block incoming secure shell connections at the firewall level. Examples of how to set up the appropriate PF rules and enable DenyHost to work with PF are available in the DenyHost configuration file (denyhosts.conf).

GCHQ: Silicon Valley is Terrorist “Command and Control” Network

Submitted by M.Onty 2014-11-05 Privacy, Security 13 Comments

The new head of GCHQ , Robert Hannigan, has spoken out strongly against American Internet companies. The BBC reports: "His concerns appear to be twofold. Firstly the fact that militant organisations such as Islamic State (IS) are using Twitter, Facebook and WhatsApp to promote themselves and the increasing sophistication that extremists are showing in their use of such platforms. And secondly he is not happy about pledges from Microsoft, Google, Apple and Yahoo to make encryption a default option to protect users from government snooping."

Serious OS X Yosemite Vulnerability Discovered

David Adams 2014-11-03 Privacy, Security 9 Comments

Emil Kvarnhammar, a hacker at Swedish security firm Truesec, calls the vulnerability "rootpipe" and has explained how he found it and how you can protect against it. It's a so-called privilege escalation vulnerability, which means that even without a password an attacker could gain the highest level of access on a machine, known as root access. From there, the attacker has full control of the system. It affects the newest OS X release, version 10.10, known as Yosemite. Apple hasn't fixed the flaw yet, he says, so Truesec won't provide details yet of how it works.

Osquery From Facebook

David Adams 2014-10-30 Privacy, Security 1 Comment

Facebook released an open-source tool for monitoring operating system state changes across large infrastructures, which could help engineers quickly diagnose performance and security issues.

Serious wget Security Flaw Discovered

Submitted by XxXxX 2014-10-29 Privacy, Security 8 Comments

A critical flaw in the open-source Wget application that is widely used on Linux and Unix systems for retrieving files has been patched quietly. A Metasploit module is available for testing. The disclosure is here. Red Hat's bug report is here.

What is the Shellshock Bash bug and why does it matter?

Thom Holwerda 2014-09-26 Privacy, Security 85 Comments

By now you may have heard about a new bug found in the Bash shell. And unless you're a programmer or security expert, you're probably wondering if you should really worry. The short answer is: Don't panic, but you should definitely learn more about it, because you may be in contact with vulnerable devices.

This bug, baptized "Shellshock" by Security Researchers, affects the Unix command shell "Bash," which happens to be one of the most common applications in those systems. That includes any machine running Mac OS X or Linux.

A very simple and straightforward explanation of this major new security issue. The OSNews servers were updated yesterday.

After Apple, Google also makes encryption default in Android L

Thom Holwerda 2014-09-18 Privacy, Security 18 Comments

Two good pieces of news today. Both Apple and Google have announced that the most recent versions of their mobile operating systems will encrypt user data by default. Google:

The next generation of Google's Android operating system, due for release next month, will encrypt data by default for the first time, the company said Thursday, raising yet another barrier to police gaining access to the troves of personal data typically kept on smartphones.

Android has offered optional encryption on some devices since 2011, but security experts say few users have known how to turn on the feature. Now Google is designing the activation procedures for new Android devices so that encryption happens automatically; only somebody who enters a device's password will be able to see the pictures, videos and communications stored on those smartphones.

Rather than comply with binding court orders, Apple has reworked its latest encryption in a way that prevents the company - or anyone but the device's owner - from gaining access to the vast troves of user data typically stored on smartphones or tablet computers.

The key is the encryption that Apple mobile devices automatically put in place when a user selects a passcode, making it difficult for anyone who lacks that passcode to access the information within, including photos, e-mails and recordings.

Xiaomi fixes privacy leak on Redmi 1s

Thom Holwerda 2014-08-11 Privacy, Security 3 Comments

A recent article in Taiwan and a related report by F-Secure raised privacy concerns by stating that Xiaomi devices are sending phone numbers to Xiaomi's servers. These concerns refer to the MIUI Cloud Messaging service described above. As we believe it is our top priority to protect user data and privacy, we have decided to make MIUI Cloud Messaging an opt-in service and no longer automatically activate users. We have scheduled an OTA system update for today (Aug 10th) to implement this change. After the upgrade, new users or users who factory reset their devices can enable the service by visiting "Settings > Mi Cloud > Cloud Messaging" from their home screen or "Settings > Cloud Messaging" inside the Messaging app - these are also the places where users can turn off Cloud Messaging.

We apologize for any concern caused to our users and Mi fans. We would also like to thank the media and users who have been sending us feedback and suggestions, allowing us to improve and provide better Internet services.

Fast response, but it's exactly this kind of shitty behaviour that especially a Chinese company simply cannot afford out here in the west. If Microsoft, Apple, or Google does something like this, they'll have armies of defenders and a huge PR department to solve it. Upcoming Chinese companies are generally much, much leaner and do not have that at all.

In any case, you're generally much better off with a custom ROM anyway, and this just yet another reason.

Ars reviews the Blackphone

Thom Holwerda 2014-06-30 Privacy, Security 6 Comments

Ars Technica reviews the BlackPhone, a device which claims to be much more secure than other smartphones.

After configuring the various pieces of Blackphone's privacy armor, it was time to check it for leaks. I connected my loaner phone to a Wi-Fi access point that was set up to perform a packet capture of my traffic, and we started to walk through the features. I also launched a few Wi-Fi attacks on the phone in an attempt to gather data from it.

For my last trick, I unleashed a malicious wireless access point on Blackphone, first passively listening and then actively trying to get it to connect. While I did capture the MAC address of the phone’s Wi-Fi interface passively, I was unable to get it to fall for a spoofed network or even give up the names of its trusted networks.

So, we've verified it: Blackphone is pretty damn secure.

A very disappointing test of the essential claim to fame of this smartphone. All Ars has done is confirm it does not leak data - something you can easily achieve on any phone. This review does not spend a single word on the baseband operating system of the device, which is a crucial part of any smartphone that we know little about. There's no indication whatsoever that the baseband operating system used by the NVIDIA chipset inside the Blackphone is in any way more secure than that of others.

Unless we have a truly open baseband processor, the idea of a secure phone for heroes like Edward Snowden will always be a pipe dream. I certainly commend Blackphone's effort, but there's a hell of a lot more work to be done.

‘Chinese Android smartphone shipped with spyware’

Thom Holwerda 2014-06-18 Privacy, Security 14 Comments

A Chinese no-name Galaxy S4 knock-off allegedly comes pre-loaded with spyware:

For the first time ever, the experts at the German security vendor have discovered a smartphone that comes with extensive spyware straight from the factory. The malware is disguised as the Google Play Store and is part of the pre-installed Android apps. The spyware runs in the background and cannot be detected by users. Unbeknownst to the user, the smartphone sends personal data to a server located in China and is able to covertly install additional applications.

The news comes from a security firm, so take it with a grain of salt, but still - this is exactly the kind of stuff legitimate Chinese manufacturers really do not want.

TrueCrypt disappears with suspicious cloud of mystery

Submitted by teo 2014-05-31 Privacy, Security 30 Comments

Over the past 24 hours the website for TrueCrypt (a very widely used encryption solution) was updated with a rather unusually styled message stating that TrueCrypt is "considered harmful" and should not be used.

Very odd story. Lots of little red flags going up all over the place.

OpenBSD forks, prunes, fixes OpenSSL

Submitted by mlauzon 2014-04-23 Privacy, Security 33 Comments

Members of the OpenBSD project, already known for the OpenBSD operating system and related projects such as OpenSSH, OpenBGPD, OpenNTPD, OpenSMTPD, are creating a fork of the OpenSSL project, likely to be called LibreSSL. (OpenSSL and OpenBSD are completely separate projects with different people working on them.)

Apparently, the focus is not so much on taking OpenSSL into a completely different direction, but more on a massive code cleanup and long-overdue maintenance.