BOB: A Blockchain Phone

November 29, 2019

Remember the comment by some FBI officials about going dark. The darkness is now spreading. “Meet BOB, World’s First Modular Blockchain-Powered Smartphone” reports that a crypto currency centric phone may become more widely available.

The write up states:

BOB runs on Function X OS, which is an open-source operating system. As it uses the blockchain ecosystem, every task on the phone, be it sending texts, making calls, browsing the web, and file sharing, all happen on a decentralized network, making it highly encrypted and thus secure. Each unit of the BOB is a node that supports the entire Function X blockchain system.

DarkCyber thinks that Mr. Comey was anticipating these types of devices as well as thinking about Facebook’s encrypted message systems.

For more details, consult the TechRadar article.

One important point: The BOB has a headphone jack. Even those concerned about privacy and secrecy like their tunes.

Stephen E Arnold, November 29, 2019

Remounting the Pegasus Named NSO

November 15, 2019

Those who care about security will want to check out the article, “Pegasus Spyware: All You Need to Know” from the Deccan Herald. Approximately 1,400 smartphones belonging to activists, lawyers, and journalists across four continents suffered cyber attacks that exploited a WhatsApp vulnerability, according to a statement from that company. They say the attacks used the Pegasus software made by (in)famous spyware maker NSO Group. Though the Israeli spyware firm insists only licensed government intelligence and law enforcement agencies use their products, WhatsApp remains unconvinced; the messaging platform is now suing NSO over this.

The article gives a little history on Pegasus and the investigation Citizen Lab and Lookout Security undertook in 2016. We learn the spyware takes two approaches to hacking into a device. The first relies on a familiar technique: phishing. The second, and much scarier, was not a practical threat until now. Writer David Binod Shrestha reports:

“The zero-click vector is far more insidious as it does not require the target user to click or open a link. Until the WhatsApp case, no example of this was seen in real-world usage. Zero-click vectors generally function via push messages that automatically load links within the SMS. Since a lot of recent phones can disable or block push messages, a workaround has evidently been developed. WhatsApp, in its official statement, revealed that a vulnerability in their voice call function was exploited, which allowed for ‘remote code execution via specially crafted series of packets sent to a target phone number.’ Basically, the phones were infected via an incoming call, which even when ignored, would install Pegasus on the device. The data packets containing the spyware code were carried via the internet connection and a small backdoor for its installation was immediately opened when the phone rang. The call would then be deleted from the log, removing any visible trace of infection. The only way you will know if your phone has been infected in the recent attacks is once WhatsApp notifies you via a message on the platform.”

Pegasus itself targets iPhones, but Android users are not immune; a version Google has called Chrysaor focuses on Android. Both versions immediately compromise nearly all the phone’s data (like personal data and passwords) and give hackers access to the mike and camera, live GPS location, keystroke logging, and phone calls. According to the Financial Times, the latest version of Pegasus can also access cloud-based accounts and bypass two-factor authentication. Perhaps most unnerving is the fact that all this activity is undetectable by the user. See the article for details on the spyware’s self-destruct mechanism.

Shrestha shares a list of suggestions for avoiding a Pegasus attack. They are oft-prescribed precautions, but they bear repeating:

“*Never open links or download or open files sent from an unknown source

*Switch off push SMS messages in your device settings

*If you own an iPhone, do not jailbreak it yourself to get around restrictions

*Always install software updates and patches on time

*Turn off Wi-Fi, Bluetooth and locations services when not in use

*Encrypt any sensitive data located on your phone

*Periodically back up your files to a physical storage

*Do not blindly approve app permission requests”

For those who do fall victim to Pegasus, Citizen Lab suggests these remedies—they should delink their cloud accounts, replace their device altogether, change all their passwords, and take security more seriously on the new device. Ouch! Best avoid the attacks altogether.

Cynthia Murrell, November 15, 2019

Mobile Phone Privacy?

September 13, 2019

Mobile devices are supposed to contain the best, reliable technology at the hands of an individual’s fingertips. Along with this great technology, we believe that our privacy and information are protected. The reason being is that we shell out huge amounts for the technology, pay a monthly bill, and expect the security to match the investment. Hackaday explains that is not the truth with the newest 5G technology in the article, “5G Cellphones Location Privacy Broken Before It’s Even Implemented.”

Our location information is one of the top things that is supposed to be secure on mobile devices, but the Authentication and Key Agreement (AKA) protocol has been broken at the most basic level since 3G, 4G, and 5G inceptions. What? Once upon a time when 3G was the latest craze, it was expensive to spoof cell phone towers and so difficult that that a device’s International Mobile Subscriber Identity (IMSI) was transmitted unencrypted. The new 5G does have a more secure version with asymmetric encryption and a challenge response protocol with sequential numbers to prevent replay attacks. However, there is a way to override this:

“This hack against the AKA protocol sidesteps the IMSI, which remains encrypted and secure under 5G, and tracks you using the SQN. The vulnerability exploits the AKA’s use of XOR to learn something about the SQN by repeating a challenge. Since the SQNs increment by one each time you use the phone, the authors can assume that if they see an SQN higher than a previous one by a reasonable number when you re-attach to their rogue cell tower, that it’s the same phone again. Since the SQNs are 48-bit numbers, their guess is very likely to be correct. What’s more, the difference in the SQN will reveal something about your phone usage while you’re away from the evil cell.”

Perhaps burner phones are a possible solution to some alleged 5G privacy issues?

Whitney Grace, September 13, 2019

Palantir: Did ICE Paid $60 Million for an App

August 2, 2019

DarkCyber spotted a short article in Counterpunch. The title?

Records Show Palantir Made $60 Million Contracting with ICE for Mobile App

The write up said:

A critical July 2019 exposé from WNYC based on documents obtained via FOIA request shows how Palantir’s proprietary software, in this case the FALCON mobile app, is essential to the removal operations of ICE and related agencies. As WNYC explained, “FALCON mobile allows agents in the field to search through a fusion of law enforcement databases that include information on people’s immigration histories, family relationships, and past border crossings.”

Counterpunch then shared its own research findings:

Counterpunch has learned that since 2016, Palantir has made more than $60 million in contract awards from ICE for access to FALCON and for Operations & Maintenance (O&M) for the mobile application. This, of course, is solely for FALCON and related services, and likely just scratches the surface of the true scope of Palantir’s profits from collaboration with ICE, to say nothing of Palantir’s lucrative relations with other government agencies such as CIA, DoD, etc.

The write up covers some other information about Palantir. DarkCyber finds the $60 million for an app interesting.

Stephen E Arnold, August 2, 2019

Mobile Phone: Tips for Addicts

May 28, 2019

Metro, a UK tabloid, reported about a study conducted at the University of Washington. The idea the researchers probed related to “triggers” which keep a person glued to his or her mobile device. “How to Resist the Four Triggers Which Keep You Addicted to Your Smartphone” reveals the tricks. The sample was 39 people aged from 14 to 64. Now I don’t want to get mathy, but the sample would get some frowns from an online Statistics 101 adjunct professor from a no name school in North Carolina. At a juicier institution, like the University of Washington, the sample is right sized.

With this cutting edge research, the secrets have been revealed; to wit:

  1. An unoccupied moment, the smartphone is there for you and me.
  2. As a break when one is working on a difficult task such as calculating or looking up in a table the sample size for a research project into “hooks” used to addict a person to a mobile phone.
  3. As a deflection action when an actual human who has taken several classes in statistics wants to engage a person like a researcher in a conversation about sample sizes.
  4. When one anticipates an email or other communication from an academic institution eager to hire a cracker jack researcher and data wrangler.

From my reading, I have gleaned some other information about the ways to make a person 14 to 64 become an addict. I offer these to suggest that the Metro’s summary of the research does not capture the scope of the subject. Here are some other addictive tricks:

  1. Approval from perceived “friends” or “persons whom one wishes to be a pal”
  2. Sex hook ups, images, etc.
  3. Rewards delivered via gameification
  4. Sex hook ups, images, etc.
  5. Desire to expand one’s contacts when looking for a job in statistics.
  6. Sex hook ups, images, etc.

Perhaps the team form the University of Washington will expand their research. On the other hand, why bother? A sample of 39 is just so right.

Oh, and the secret to breaking the addiction? Turn off the gizmo.

Stephen E Arnold, May 28, 2019

How Does One Access an iPhone?

May 9, 2019

If you are interested in accessing a locked iPhone, you may want to add this write up to your reference file. DarkCyber is not sure the three ways to work around the iCloud lock cover the waterfront, but the information is suggestive. See “How Hackers and Scammers Break into iCloud-Locked iPhones.” DarkCyber is not thrilled that this type of information is floating around untethered. Just our viewpoint, of course. Vice’s editorial judgment is interesting.

Stephen E Arnold, May 9, 2019

GPS: Ubiquitous and Helpful in Surprising Ways

March 6, 2019

Here’s a little write-up that highlights the power of GPS and WiFi tracking. Digital Trends reports, “It Turns Out That Find My iPhone Is Really Good at Finding a Stolen Car, Too.” Writer Andy Boxall relates:

“After stopping at an intersection, Chase Richardson was carjacked by an armed man who shouted for him to get out of the vehicle. Sensibly complying, Richardson got out, but at the same time left his work-issued Apple iPhone in the car. The criminal also demanded Richardson’s wallet and his own personal phone, then got in the car and drove away. The police arrived after Richardson called 911 at a Walgreens store, which is when the Find My iPhone feature was called into action. The service uses GPS to generally locate a registered device, which in this case was the work phone. The police apparently used Find My iPhone in real time to track down the stolen car. A police helicopter was called in to assist after the car was located, as the thief tried to evade arrest.”

We are pleased to learn Mr. Richardson was not hurt during the carjacking. Boxall mentions other cases where Find My iPhone has led to arrests, and notes similar tools like Google’s Find My Device, Samsung’s device location service, and third-party companies like Cerberus Anti-Theft. Such tools can be a huge help if someone makes off with your phone—or your car. Just remember that tracking software can have unintended consequences; the article closes with this kind wish:

“Whichever you choose, we hope it will only ever be used to find your phone down the back of a couch, and nothing more serious.”

We agree.

Cynthia Murrell, March 6, 2019

Google News: Not So Much News As Control and Passive Aggressive Offense

February 12, 2019

I read “One Analyst’s Attempts to Demystify the Types of Traffic Google Sends Publishers.” The write up explains some of the clever ways Google manages its traffic and any related data linked to the traffic and content objects.

To put it another way, Google is continuing its effort to control content for its own purposes, not the publishers’, not the users’ or the advertisers’ goals.

The article makes it clear that Google is adapting in a passive aggressive manner to the shift from desktop boat anchor search to the more popular mobile device approach to search.

Users want information and no longer are troubled with thinking up a query, deciding what service to use, or questioning the provenance of the information.

The write up takes a bit of time to figure out. There are acronyms, Googley lingo, and data which may be unfamiliar to most readers. Spend a few minutes and AMP up your understanding of what Google is doing to help out — wait for it — itself.

Surprise, right?

The downstream implications of this approach are interesting. Perhaps an analyst will tackle the issues related to:

  • Time disconnects between event and inclusion of “news”
  • Ability to “route” and “filter” from within the Google walled garden
  • Implications of inserting “relevant” ads into what may be shaped streams so that ad inventory can be whittled down.

Interesting and just the tip of the Google content management iceberg.

Stephen E Arnold, February 12, 2019

Once a Phone Company, Always a Phone Company

February 12, 2019

American life is not complete without the media generating some form of fear. The newest craze scaring people from the airwaves is their location data. PPC Land reports the story in, “Carriers Are Only One Source Used By Data Aggregators, And This Source Is Now A Threat In The US.” One way that mobile phone providers make a profit is selling their customers’ information to advertisers and other third party agencies. Among the user information sold is a customer’s location.

It sounds banal at first—your location is sold, then ads for specific products and services near you pop up on your mobile device. Then the Big Brother syndrome and privacy fears kick in. The big stink is that bounty hunters can use customers’ data to track targets down to their specific location. Yes, that is scary, but how many people have bounty hunters stalking them?

Mobile phone carriers assure customers that their safety and privacy are top priority. Roadside assistance is referenced as one way specific location information is used. The FCC and Congress are abuzz about this threat, but how are phone providers really selling the information?

“Mobile Carriers use data aggregators to monetize location data. Verizon has contracts with LocationSmart and Zumigo. Verizon says the location data used by the location aggregator programs are limited to coarse (rather than precise) location information. Coarse location information is derived from the Verizon network and is significantly less accurate than a precise location. Precise information are usually from GPS, and is obtained with apps installed on mobile phones (like maps, or car services).”

But mobile phone providers are not the only ways to track an individual’s location: cell IDs, Wifi, beacons, landlines, carriers, beacons, SDKs on apps that use locations, GSIDS, and IP addresses are all used to track location. Phones are a handy device.

Whitney Grace, February 12, 2019

Mobile Search: Pervasiveness Arrives

December 13, 2018

If you want to order a pizza, there is an app for that. If you want to shop for clothing, there is an app for that. If you want to design an app, there is an app for that and if you want to search on your mobile device you have to use an app…until now. VentureBeat shares that there is a new way to search on mobile devices without having to open an app: “SwiftKey Now Lets You Search The Web From The Android Keyboard App.”

SwiftKey, a Microsoft owned company, invented a new way to search on mobile devices, specifically Android phones. The SwiftKey is a keyboard app that allows users to type quicker on touch screens and now they can search the Internet directly from the keyboard. SwiftKey also users predictive analytics to make suggestions and they can swipe over letters instead of having to individually touch them. It is powered by Bing search, not a surprise.

“The update seems to be mostly about enabling users to share content they find on the web without having to switch between multiple apps on their phone. For example, you can search for local restaurants inside SwiftKey and give friends recommendations by screenshotting, cropping, and sharing the results. Or let’s say a friend sends a message asking you to look into some flight options for an upcoming trip. Rather than switching from WhatsApp to Google or SkyScanner, you can simply bring up the little toolbar at the top of the keyboard, enter your flight criteria, and share what you find through WhatsApp without leaving the service.”

Another handy feature is if a user types in a URL into the search box and takes them directly to the Web site over a search results list.

The SwiftKey is competition for Google’s GBoard. It streamlines mobile search by taking out some of the clunky steps, but it is going to have issues before it is perfected.

Whitney Grace, December 13, 2018

Next Page »

  • Archives

  • Recent Posts

  • Meta