Skip to content

Posts tagged ‘privacy’

18
Nov

Securing Leopard – 10.6 Edition

I’ve finally re-written my article on Securing Leopard, with some updates to reflect the changes made in 10.6. This is still an early edition, and I’d be happy to hear feedback/suggestions (contact form) on how I could improve it.

The article is aimed at new and developing Mac OS X users, and covers a variety of suggestions on how to quickly and easily improve the security of your (Snow) Leopard install. It also provides tips on how to manage your privacy and protect your personal information.

It includes a quick checklist which can help when trying to secure an install of Mac OS X. Enjoy!

Securing Leopard

Securing Leopard: 10.6 Edition

17
Nov

Gizmodo Leaks Body Scanner Images

The backlash against the use of body scanner technology, that I reported on recently, rages on. Following an investigation into the use of body scanners, Gizmodo found that US Marshals saved 35,000 scans, and have leaked some of the images they were able to obtain. The image below is one of those images.

The resolution of these images, taken with a Gen 2 millimeter wave scanner, is extremely low compared to the more advanced (and potentially harmful) ‘naked’ x-ray backscatter technology. The point being highlighted by Gizmodo is not the privacy-invading nature of body scanners, but instead they reveal how images are being stored on the machines despite the TSA assuring everyone that body scanners “cannot store, print, transmit or save the image, and the image is automatically deleted from the system after it is cleared by the remotely located security officer.” Clearly isn’t entirely true (surprised?).

I think it points out the particular flaw with blindly allowing governments to implement these and other kinds of surveillance, tracking, and monitoring mechanisms. It’s fine when you trust the government to abide by a set of acceptable rules, and most people say they have nothing to hide (which I agree with in most cases). The issue is that the way those monitoring mechanisms, and personal (borderline private) information about you, are used can be changed at any time, regardless of what the ‘rules’ are meant to be (and laws can be changed  – consider post 9/11). If, for whatever reason, a government somewhere down the line decides they want to exert more control over its citizens, the internet, etc, they will just have to turn to the plethora of technologies that are currently in the process of being implemented.

As travelers we’re being treated with more and more suspicion, and people are now starting to put their foot down. Too little too late? Just recently, John Tyner was thrown out of an airport for opting-out of a body scan, and then refusing to the new TSA ‘groin-touching’ pat-down.

The difficult question is how do we allow governments to implement essential and appropriate security mechanisms, in such a way that does not impede the freedom and civil liberties of individuals? In my opinion, non-invasive passive scanning and detection methods would be one way to go, such as more chemical/explosive detection technology. Ultimately if someone wants to get something on board, it is much easier to get it through security in your carry-on than on your person. Obfuscating dangerous items such as non-obvious blades or even explosives into already complex elements such as laptops would probably pass security checks if done properly. And don’t forget that there are many plastic or ceramic-based tools and weapons that can be just as dangerous as knives. At this point I should probably point out that I’m particularly resentful of the pitiful little knives they give us on flights nowadays.

The security of the internet is a similar story. Mechanisms that give governments exclusive control, such as the proposed Internet kill-switch and blacklist, are not the answer, and somewhere down the line will probably be used for more harm than good.

Note: The image of the lady above is not an actual body scan, and is simply there for illustrative purposes to (aesthetically) demonstrate where we’re headed. ;)

[Update] Body scanner misses 12-inch razor blades

17
Nov

Facebook Announces Centralized Messaging

Facebook LogoI was tempted to title this post “How Mark Zuckerberg Reads Your Email”, but never mind…

Facebook today announced that they have developed centralized messaging functionality, which will allow people to communicate over a variety of different mediums ‘seamlessly’. Soon you’ll be able to send your friend a text message, who will receive it as an email (or chat, or message, etc). Facebook have basically created a mechanism where any text-based communication media to or from an individual will be organized into a single thread.

In theory I find this to be a great idea. Seamless messaging is something that would solve many problems, and make life a bit easier. Unfortunately there are a few issues that I can see:

  1. Centralized Messaging: By virtue of this service’s actual design, I’m concerned about storing absolutely all of one’s communication in one place. Currently if someone can get into your email, they can read your mails; if they can get into your Facebook, they can read your messages and chats; if they can steal your phone, they can read your SMS. If someone adopts Facebook’s approach to centralized messaging, all of their correspondence is in one place. This means that if your account, or Facebook itself, is compromised, the entirety of your correspondence is compromised.
  2. Non-synchronous Communication: Let’s face it… if I want to chat to someone, I will knowingly use a chat client. Why? Because I’m prepared for that style of short and quick communication. Email, on the other hand, is not as agile. Although it’s not uncommon to rapidly exchange several emails in the space of five or ten minutes, you wouldn’t want to have a full conversation using that medium. The issue here is that people who prefer chat or SMS, will attempt to communicate with people who prefer email or messages. Each medium invokes a different behaviour and expectation.  As a result, an email user will receive tons of really short chat-style one-liners filling up their inbox (with subjects as “(No Subject)”), and SMS users will (somehow) be receiving long-ass messages from email or message users.
  3. Perpetual Storage: At the moment if I send someone an SMS, I know that message will probably get deleted eventually when they choose to prune their texts. I also have a tiny bit more faith that SMS isn’t as easy to intercept, and generally only the person with access to the corresponding phone will be able to read it (as opposed to email where anyone with the username/password or able to intercept the network traffic can read them). If I send someone a message on AIM or some other IM, that message will usually only be logged on their local machine (if at all). In this new model, Facebook users, as well as non-Facebook users corresponding with Facebook users, would be delivering their conversations to Facebook for perpetual storage (they advertise this as a feature). Note that it’s not yet possible to delete an individual message from a conversation – you’d have to delete the entire conversation.

I want to like this feature, and to be honest centralized messaging in some form (not necessarily Facebook’s) is the future. Unfortunately that will mean entrusting much of our correspondence to some entity, and that entity (be it Google, Facebook, or someone else) will undoubtedly come under fire for having such a dangerous amount of insight and monopoly over the way we communicate.

15
Nov

Man Thrown Out of Airport for Refusing Pat-down

Hot on the heels of my last post about body scanners and invasive pat-downs, John Tyner apparently decided to opt-out and told the TSA agent at San Diego airport (SAN) that he did not want his groin to be touched. Specifically his words were: “If you touch my junk, I’ll have you arrested” – which is a phrase we should all say to a TSA agent at least once in our lives (women that includes you). To cut a long story short, the situation was escalated and resulted in him being thrown out of the airport. He then went home and posted about the incident on his blog, along with videos that were surreptitiously recorded by his cell-phone. Drawn-out but worth a watch listen (unless you like watching a ceiling move):

Part 2, Part 3

When asked by his father-in-law why he was being so obstinate about opposing this encroachment on his civil liberties, John replies “if I don’t do it, nobody will”. It’s nice to see someone have the junk to stand up for what they believe in, especially if they’re willing to miss a flight because of it. My guess is he really didn’t want to fly with his father-in-law.

Funny thing is that after being ‘thrown-out’, he was told that he couldn’t leave the airport or face a civil lawsuit and a $10,000 fine if he didn’t come back and finish the screening. Clearly John didn’t want the screening, so at that point I’m wondering whether he might have to live within the confines of the airport for the rest of his life. Thankfully he told the TSA to “bring it” and just left. You tell ’em John.

In related news: BoingBoing suggests this book on how to explain to your child why they will be felt up by a random stranger in a uniform the next time you fly. I hope they use baby oil…

Source: Network World

[Related] Body Scanner Images Leaked!

10
Nov

Airport Body Scanners: Questionable Security and Privacy

The idea of naked images of children aside, something about this picture is particularly disturbing to me. I don’t know if it’s the criminal-esque ‘hands-up’ pose the kids are forced to adopt, the big yellow radiation warning sign, the fact that anyone on the other side of the machine has a clear view of the screen, or that the kid in front appears to have taken a bit too much radiation to the head. Ok, I jest with that last one, but there is something inherently wrong with this image. Read moreRead more

21
Oct

Facebook Game Producer Sued for Privacy Infringements

Facebook LogoZynga, developers of many popular Facebook games including Farmville, Mafia Wars and Texas HoldEm, are being sued (class-action style) in Federal Court for supposedly transmitting sensitive personally identifiable information about their users. Zynga users are forced to provide information such as name, gender and address when registering. Passing this personal information onto a third party is a violation of Facebook’s own ‘privacy policy’, as well as certain state and federal laws. The Wall Street Journal recently carried out an investigation into Facebook’s privacy practices, and found that many Facebook apps transmit personally-identifying information.

If the lawsuit is successful, Farmville users will be compensated with three cows and a donkey each. *snicker*

19
Oct

Persistent Tracking using Supercookies and Evercookies

Normal websites use cookies to keep track of their visitors, either to remember that they are logged in, track statistics, or a number of other purposes. Sites can usually only track users while they are browsing that actual site (apart from Google who tracks you more or less wherever you go), however the past few years have revealed more and more ways web users can be tracked.

The concept of supercookies and ubercookies is not entirely new, but has been refined recently to turn them into digital cockroaches – very hard to permanently get rid of. Supercookies are basically an amalgamation of different software features that can be used to create a uniquely identifying token, usually one that is hard or too convoluted to delete. Now that HTML5 is becoming more widespread, there are even more options than before.

Modern supercookies comprise a number (or all) of the following:

  • Standard HTTP Cookies
  • Local Shared Objects (Flash Cookies)
  • Silverlight Isolated Storage
  • Storing cookies in RGB values of auto-generated, force-cached PNGs using HTML5 Canvas tag to read pixels (cookies) back out
  • Storing cookies in Web History
  • Storing cookies in HTTP ETags
  • Storing cookies in Web cache
  • window.name caching
  • Internet Explorer userData storage
  • HTML5 Session Storage
  • HTML5 Local Storage
  • HTML5 Global Storage
  • HTML5 Database Storage via SQLite

Samy Kamkar recently released Evercookie, a JavaScript API for creating extremely persistent browser cookies. The list above is what is what Evercookie uses to create them. If websites were to start using these techniques, they would be able to uniquely identify you (as a user, not a person) each time you visited, even if you deleted your cookies, cleared your cache, and removed your history (or used a private browsing feature). Due to the use of shared objects, such as Flash, some cookies are persistent even across different browsers!

Ultimately, I wouldn’t panic and stop surfing the web just yet, but this goes to show how the evolution of the browser (and countless plugins that now go with it) is having an effect on privacy and security (which can’t quite keep up the pace set by innovation). Dominic White describes how to delete the Evercookie when using Safari on OSX. Others have written about how to do the same on Firefox and Chrome. One reddit user has created a pseudo lockdown-script which improves the security and privacy of Firefox by making some configuration changes (eg. disabling prefetching, geolocation, caching, etc).

This post by Christopher Soghoian provides a good argument for why privacy (and security, I would add) should be adopted in web browsers by default, instead of letting users fend for themselves. Some browsers are making an effort by adding features such as private browsing, cross-site scripting protection, and Google SafeSearch (although this impacts privacy by sending Google every URL you browse to), however all too often browser plugins and add-ons are given too many privileges.

Browser security and user awareness are becoming more important than ever as traditional programs are phased out and replaced by web applications. Unfortunately both of these are still lagging a bit behind.

2
Sep

Mobile Web Identity Leakage in HTTP Headers

This year has seen some interesting research (Mulliner and xuf) into the way mobile carriers modify users’ HTTP traffic when surfing the web. Unlike most ISPs, which provide you with a direct pipe to the internet (with little or no filtering), mobile phone carriers behave in a much more gateway-like fashion. As such, mobile carrier proxies tend to add information into the headers of HTTP traffic, some of it just for session-tracking, others containing interesting data.

Of all the information added into HTTP headers, by far the most interesting is the inclusion of the user’s handset IMEI (a unique identifier) or mobile telephone number. These are inserted into headers, such as X-Network-info, and is then available to anyone with access to the network traffic. If a website is so inclined, they can log the headers associated with HTTP requests and then use this information to further track and/or advertise to you. If I were so inclined, I could wait for a mobile browser to leak the visitor’s telephone number and give them a call!

Your browsing activities are already very trackable thanks to a number of things including browser fingerprinting, but this issue now makes you potentially personally identifiable – and trackable. Mulliner’s set up a simple Privacy Checker, where you can see what headers your mobile browsing creates.

X-Network-info
22
Aug

Disable Facebook Places – or – Location-Stalking for Fun and Profit

In a direct strategic offensive on Foursquare’s service and a long-term plan for world domination, Facebook recently introduced their own service dubbed Places. These two services allow users to ‘check-in’ to virtually any venue/event, thus sharing their location with friends (or the world). This introduced an awesome new sport known as Foursquare stalking where one could follow the check-ins of known or random people (eg. by searching for 4sq.com on Twitter Search), call up the venue they are currently at, and ask to speak to the person… and then doing this for every location they check-in to. Tremendous fun. The guys at PLA Radio had fun prank-calling people using this, with amusing results.

Apparently the bald fat guy below just got home. Since he is kind enough to post the actual location of his domicile, all a thief has to do is wait until he checks-in somewhere far away, and then proceed to leisurely rob him of all his stuff. Sorry baldfatguy… didn’t mean to pick on you but you were at the top of the list.

Foursquare Tweet

Surely Facebook’s entry into this domain will allow for more stalking goodness. Another interesting perspective is using Places to create an alibi by spoofing one’s GeoLocation. Anyway, onto the essentials. At least most of us can just avoid using services like Foursquare… but if you have a Facebook account, it’s yet another privacy setting you will have to set yourself.

To Disable Places: Log in to Facebook and go to the Privacy Settings. Click on Customize Settings at the bottom, and then modify the Things I Share settings (you will need to select Custom from the dropdown menu in order to choose Only Me). These settings are only important if you do actually use Places.

Facebook Places Settings

Next go down to Things Others Share, and uncheck Friends can check me in to Places.

This one is particularly important as it prevents trigger-happy privacy-ignorant friends (you know, the ones who take photos of everything at a party only to upload them the next day and tagging everyone) from checking you into every location you ever go to in their presence.
Friends can check me in to Places
Facebook have provided a video which explains how to control your Places settings.
19
Aug

Hack Uses Geolocation to Pinpoint Your Location

In one of the more simple yet clever attacks I’ve seen this year, at BlackHat and Defcon, Samy Kamkar (author of the 2005 Samy MySpace worm) showed how javascript and geolocation could be used to more or less pinpoint a user’s location. An attack Samy dubbed ‘XXXSS‘.

The attack works by using javascript to obtain the MAC address (a unique hardware identifier) of the victim’s network router or gateway, and then submitting it to Google’s Geolocation service to obtain the coordinates. Read moreRead more

css.php