Category Archives: Hacking

Software Industry Greed is Driving the Assault on our Privacy & Security

The motivation to release software, without proper testing, in order to generate a quick buck is as much of a threat to our security and privacy as the activities of hackers and alphabet agencies. It is time that software companies started to pay the price for the sorry mess that their greed is helping to create.

Once upon a time these matters could be considered in isolation but with the “Internet of Things” connecting millions more devices every day we are headed for a world that will have 28 billion IoT devices by 2020.

Consumer concern will not halt the rollout. A staggeringly high number of consumers hold serious concerns about the possibility of their information getting stolen from everyday devices – their smart home, their tablet, their laptop. One would think therefore that this concern would pressure software manufacturers to be more rigorous in their pre-GA testing activities. Not so.

Why? Because so much of this IoT stuff is embedded and consumer awareness is mainly limited to the high profile exposures. Consumers are not hesitating to purchase connected devices because consumers do not know that the devices are connected.

Samsung’s SmartThings smart home platform is a leaky colander of loosely connected hack prone software. IoT security hardening is not just about the particular application but also about building security into the network connections that link applications and that link devices.

And then there is the “Data”. The amount of this stuff that is generated by IoT is intractably large. As few as 10,000 households can generate 215 million discrete data points every day. This creates more entry points for hackers and leaves sensitive information vulnerable.

The number and variety of privacy attack vectors becomes unmanageable very quickly. From the CIA hacking your Samsung TV, uBeacons doing their bit (uXDT & Audio Beacons – Introduce your Paranoia to your Imagination), hackers controlling your car, it’s a worryingly real threat to the personal security and privacy of every one of us.

If the CIA’s Directorate of Digital Innovation (DDI), who are tasked with delivering cyber-espionage tools and intelligence gathering capabilities, cannot even secure their own USB drives then what chance do the rest of us have.

Unfortunately the answer is that we have no chance.

ENDS 

Mass Surveillance & The Oxford Comma Analogy

Acknowledgments, Contributions & References: This blog post was written in collaboration with and using contributions from Mr. Dean Webb (find Dean’s profile on PeerLyst). The clever and insightful bits are all Dean, the space fillers and punctuation are mine – except the “Oxford Comma” analogy, which even though it is lifted from @Grammarly on Twitter, is mine – and I like it (a lot). Enjoy.

Who Do We Like, Who Do We Dislike (Today)

Wearable tech is on its way, for surveillance during times when one is away from the vidscreen. But we need this stuff in order to protect against Eurasia. We have always been at war with Eurasia. We will always be at war with Eurasia until 20 January, at noon. Then we will always have been at war with Eastasia. And then we will need all this stuff to protect against Eastasia.

On a more serious note, anonymity has been dead for quite some time. As an example, about 10 years ago Dean Webb was running a web forum for students involved in an academic competition.

He and other teachers had volunteered to be admins for the board. They had a student that began to harass others on the board and post some highly inappropriate material. They banned his account, and he would connect again with another account.

So, Dean took down the IP addresses he’d used for his accounts and did a quick lookup on their ownership. They were at a certain university, so he contacted that university with the information and the times of access and they were able to determine which student was involved.

He was told to stop posting, or face discipline at the university. That got him to stop.

Simple Methods, Complex Implications

The point is, that IP address and timestamp for most people is going to be what gets them in the end. They don’t know what a VPN is from a hole in the ground, let alone what a TOR node is.

At best, most of them will use a browser in anonymous / incognito mode, without realising that cookies are still retained and updated, credit card transactions remain on the record, and ISPs will still retain IP address information with timestamps.

It could be argued that a Layer 2 hijacking of someone else’s line is the way to go anonymously, but that involves a physical alteration of someone’s gear, and that means physical evidence, which is very difficult to erase completely.

Even if anonymity is not completely dead (mostly dead, perhaps?), it is certainly outside the reach of most people because they lack general IT knowledge about the basics of the Internet.

I (Graham) was met with the following comment when I posted a tweet some time before Xmas 2016 about Identity Theft:

“despite the hysteria the theft of most peoples personal information is / will be inconsequential”

The use of the word “inconsequential” by the commenter on my post reminded me of the hilarious Doctor Evil therapy session monologue in the Austin Powers movie when Doctor Evil stated, when asked about his life, that “the details of my life are quite inconsequential”. But 60 seconds of monologue later it was quite clear that they were far from “inconsequential” – it is a matter of perspective as to what is and what is not. That is the problem. And that is the potential worry.

Threat Awareness & Counter Measures

The vast majority of people and their browsing habits are innocuous. The point though that the comment misses and which is the point that Dean makes in his comments about the average John Q. Citizen’s awareness of the threats and the countermeasures available is that the public in general has moved their private communications on to a platform where they do not understand the implications of the ability of externals to eavesdrop or to store and reference data at a future point.

There was a blog post I (Graham) made some time ago about the risk of “profiling” and of “false positives” and the threat that they posed especially with respect to miscarriages of justice. (See “The Sword of Islam” story below)

The point is not whether “the theft of most peoples personal information is / will be inconsequential” or the storage of most peoples browsing history or contacts with other parties is / will be inconsequential or not – the point is that it can be made to look very different to what was actually happening originally.

Like a misquoted partial comment in a newspaper article – actions taken out of context can look very different.

The Oxford Comma Analogy

Recently I posted a tweet about the Oxford comma and it does indirectly inform the point that I am trying to make here:

Excerpt begins from Grammarly

“Unless you’re writing for a particular publication or drafting an essay for school, whether or not you use the Oxford comma is generally up to you. However, omitting it can sometimes cause some strange misunderstandings.

“I love my parents, Lady Gaga and Humpty Dumpty.”

Without the Oxford comma, the sentence above could be interpreted as stating that you love your parents, and your parents are Lady Gaga and Humpty Dumpty. Here’s the same sentence with the Oxford comma:

“I love my parents, Lady Gaga, and Humpty Dumpty.”

Those who oppose the Oxford comma argue that rephrasing an already unclear sentence can solve the same problems that using the Oxford comma does. For example:

“I love my parents, Lady Gaga and Humpty Dumpty.”

could be rewritten as:

“I love Lady Gaga, Humpty Dumpty and my parents.”

Excerpt Ends

The analogy serves to demonstrate one of the main concerns of mass surveillance and mass retention of user data. People are now being profiled and tracked and their behaviours stored and analysed and they do not know why or by whom or for what purpose – they barely understand how to use a browser.

In the wrong hands that potentially makes them cannon fodder. Accuse me of being alarmist and dramatic – fair enough – so did everyone four years ago when I wrote about mass immigration as a weapon, the rise of radical Islam and the dangers of the USA supporting a sectarian Shi’a government in Baghdad, the marginalisation of Sunnis and the Ba’ath party, the randomness of the Arab Spring, the threat of Libya turning into a terrorist haven and so on.

The point is people ignore these developments at their peril but you may as well be talking to a concrete block. You can make all the compelling philosophical points that you like to someone but if they do not have the capacity to understand them then you are wasting your time.

And most of our politicians fall into that category.

Mass Profiling, Mass Surveillance Will Be Inconsequential Until It Isn’t

Dean once met a man named Saifal Islam. He has a devil of a time getting on an airplane because a terror group has the same name – “Sword of Islam”.

He is constantly explaining that the man (him) isn’t the group (them) and that he’s had his name longer than they’ve had theirs. That, yes, the group (them) should be banned from getting on airplanes, but that, no, the man (him) should be allowed on the plane.

Hell of a false positive, and that’s not the only one. Mismatches on felon voting lists, warrants served to the wrong address for no-knock police invasions, people told that they can’t renew driver’s licenses because they’re dead, the list goes on.

Be happy in the knowledge though that your data is apparently “inconsequential” and this privacy debate and the growing intrusion on your personal life is all “hysterical” alarmism.

You can use that statement when you are in the dock defending your very own hysterical “false positive” – no charge.

The next post will be “KarmaWare & Thieves of Thoughts” again in collaboration with Mr. Dean Webb.

ENDS

The Irish PM, Cabinet Ministers & Head of Police Force use Gmail for Official Business

The leader of the country whose government presides over the data protection compliance of a host of global social media sites uses Gmail for government business.

Let’s just think about that for a second. The guy uses a service who in a 2013 filing, while defending a data-mining lawsuit, said that people have “no legitimate expectation of privacy in information” voluntarily turned over to third parties.

Ireland sits next door to the most surveilled society on the planet who last week passed into law the most intrusive surveillance laws ever enacted in a democracy. This is what the British have publicly declared they are willing to do to their own citizens and foreign residents and they even had the audacity to spin “that the protection of privacy is at the heart of this legislation“.

What do you think they might have in their more covert bag of tricks for use on foreign governments?

One wonders why the Irish so close to the British geographically are as so far removed from realising the national security implications of having a kindergarten knowledge level with respect to mass surveillance, industrial espionage and cyber security.

The whole sorry mess and the puerile responses from the PM’s spokespersons made to queries regarding the Irish prime minister’s use of the service were widely covered in the last two weeks by The Irish Daily Mail and The Irish Mail on Sunday in articles by  Senior Reporter Seán Dunne.

How much of Ireland’s bargaining strategy with respect to the Brexit negotiations will the British authorities possess foreknowledge of when a teeny-bopper hacker who took a few hacking 101 classes at the local tech could access the comms of the Irish politicians centrally involved in the discussion.

This blog has made it’s view of Ireland as a Privacy Advocate and the abilities of the Office of the Data Protection Commission in Ireland well known.

The office of the Data Protection Commissioner in Ireland was established under the 1988 Data Protection Act. The Data Protection Amendment Act, 2003, updated the legislation, implementing the provisions of EU Directive 95/46.

The Acts set out the general principle that individuals should be in a position to control how data relating to them is used. The Data Protection Commissioner is allegedly responsible for upholding the rights of individuals as set out in the Acts, and enforcing the obligations upon data controllers.

The Commissioner is appointed by Government and is allegedly “independent” in the exercise of his or her functions but has fallen foul several times to allegations that they are inherently political in their motives and policy.

The DPC have been censured by The High Court in Ireland regarding their a decision to refuse to investigate a data privacy complaint by Austrian law student Max Schrems against Facebook and his attempt to expose the cosy attitude to abuses of Safe Harbour.

Digital Rights Ireland have also claimed in a 2016 lawsuit that the Irish State has not properly implemented EU legislation on data protection. They claim “Ireland’s data protection authority doesn’t meet the criteria set down by the EU case law for true independence,” it added “As the Irish government has refused to acknowledge this to date, we are turning to the courts to uphold Irish and EU citizens’ fundamental rights.”

The group also claims Ireland has not properly implemented EU legislation that requires data protection authorities to be genuinely independent from the government.

DRI had previously taken a case to the Court of Justice of the European Union that led to an EU data-retention directive, then the basis for Irish law, being thrown out in 2014.

Facebook love the Irish Data Protection Commission as do all the other social media giants who not only get a free run enjoying multi-billion dollar tax breaks while the people of Ireland pay for their free ride with swingeing austerity.

Last week I received an email from Twitter and when I clicked the link I read:

“Twitter’s global operations and data transfer – Our services are a window to the world. They are primarily designed to help people share information around the world instantly. To bring you these services, we operate globally. Twitter, Inc., based in the United States, and Twitter International Company, based in Ireland, (collectively, “we”) provide the services, as explained in the Twitter Terms of Service and Privacy Policy. We have offices, partners, and service providers around the world that help to deliver the services. Your information, which we receive when you use the services, may be transferred to and stored in the United States, Ireland, and other countries where we operate, including through our offices, partners, and service providers. In some of these countries, the privacy and data protection laws and rules on when data may be accessed may differ from those in the country where you live. For a list of the locations where we have offices, please see our company information here.”

The section above that I have highlighted and italicised prompted me to tweet:

I followed this tweet up with an emailed request for clarification – which much like my many failed attempts to acquire the elusive “Blue Tick” was met with a stony silence. Which is code I think for “Please go away Mr. Penrose you are a massive pain in the neck”.

I also sent an email to the lovely Ms. Dixon, Irish Data Protection Commissioner requesting a comment. Do I need to tell you what I received? Well – just in case you own an irony bypass – I received nothing.

When regulation is in the hands of amateurs and when policy is set on subjects by people with no qualifications in the matter and when both of them are in the pay of those they are inspecting then what hope do we have really? Again recognising that some do not recognise rhetorical questions, the answer is that we have none.

END

Hijacked Jihadi Forum “Asrar Al­Ghurabaa’“ – Offense & Exploitation

In late 2013, following on from the general panic surrounding the reliability of previously trusted technologies – as a direct result of the revelations made by snowden‍ and greenwald‍ – ISIS‍ “declared” that they had launched a new encryption‍ service called Asrar Al­ Ghurabaa’.

It was described as being the first website for secure communications. A forum used by jihadists calledShabakat Al Iraq Wal Sham announced the launch. The announcement declared that the new resourcefor jihadis would be a rival to Asrar AlMujahideen (Mujahedeensecrets which was launched circa 2007).

The new service was an NSA‍ front and was to be found at asrar006.com. It allowed the input of text which was then encrypted‍ or decrypted‍ , as required. Simply put, rather like the google translate service it applied the required encryption keys to inputted text strings resulting in a “translation”.

It did not allow for message transmission but was more “accurate, secure, and user friendly than Asrar Al­Mujahideen” according to the statement. The service required no software downloads or installations and therefore removed several points of potential risk associated with the Asrar Al­Mujahideen alternative. No code could be injected, files infected and so on.

Within a couple of days the Global Islamic Media Front (GIMF‍ ) denounced the new encryption platform in a statement “Warning About the Use of the Program ‘Asrār al-Ghurabā” stating:

“We warn all the brothers using the new encryption program called “Asrar al-Ghurabaa” – the program is suspicious and its source is not trusted. Likewise, we confirm that there wasn’t any relationship between the program “Asrar al-Ghurabaa” and the Front’s encryption program “Asrar al-Mujahdeen”, and therefore, we advise and warn the brothers not to use the program “Asrar al-Ghurabaa” entirely!

We also warn of using any encryption program which hasn’t been published through the Global Islamic Media Front or Al-Fajr Center for Media. And lastly, we remind that the sole source to download all of the technical programs for the Media Front: Mobile Encryption Program Asrar al-Dardashah Plugin Asrar al-Mujahideen Program”

END

So You Want To Be A Digital Ghost – Introduction

This series of posts are provided as a guide to the private citizen who holds concerns regarding their information security and the protection of their data from unauthorized access from state and non-state actors.

This information is not intended for use for any other purpose in particular to access the deep web or dark net to conduct illegal transactions or engage in illegal activities.

Caveat

The implementation of these guides are intended for legal use and not to facilitate acts of criminality – these guides are for those of us who seek to protect our privacy in the belief that in a democracy every law abiding individual is entitled to a private life.

Caveat on the Caveat 

These posts are not intended to be Blackhat however like any hints and tips on any subject they can be used the wrong way.

If you are the type of person who feels the need to use internet to hire a hit-man to shoot your dog, buy poor viagra substitutes online or trade bomb making tips with your jihadi buddies then these guides are just as effective but …..

You also leave non-digital footprints and the forums which you may intend to visit, using the anonymity tools and tips described herein, are no doubt compromised and riddled with honeypots and lurking super secret squirrels and in those we trust.

Getting What You Want 

Some readers looking for answers / hacks / links / shortcuts will be aware of elements of the content of these posts and to avoid frustration a section at the top of each new post will call out what subject is being discussed in that post and what sub categories it contains – for example:

POST: Internet Censorship Software & Workarounds
Sub-Categories: Blue Coat Systems; SmartFilter; Fortinet; Websense; Netsweeper; Making Invisible Spyware Footprints Visible; Keyloggers; Malware Detection; Man in the Middle; TSCM; 

You will then be able to jump to the section you are interested in – or wholly ignore the post – or patiently wait for your section of interest. This series will run for twelve months with three posts per week so thats 156 pearls of wisdom riddled, real life expertise indispensable posts for you.

A complete contents and navigation guide will be included in the next post with the subject of each post, sub-categories, a clickable link and an intended publication date.

Subscribe to New Posts

To be notified as each post is published please subscribe to the blog – over there on the right – yes over there in the right column at the top where it says “Follow by Email”.

No new content, no email for you – ever – and we won’t sell your email details to the NSA either and we are subpoena proof too so we can’t be forced to either.

END.