Mobile Security Is Possible, But It Is Work
June 10, 2020
Ads are a pain on desktop devices, but they are even more annoying on mobile devices. The worst type of ads are the ones where the X is hidden, making it impossible to close the ad. Mobile ads are only getting worse as mobile devices become SOP and IT-Online shares more insight into the “Mobile Adware: The Silent Plague With No Origin.”
The article focuses on a research from the Check Point’s Cyber Security Report 2020 and the insights are alarming. According to the security report, 27% of companies experienced a security breach through a mobile device. What is even worse is that most companies do not prioritize mobile security, making mobile devices the most vulnerable area. Check Point’s regional director stated:
“ ‘It only takes one compromised mobile device for cybercriminals to steal confidential information and access an organisation’s corporate network,’ explains Pankaj Bhula, Regional Director: Africa at Check Point. ‘More and more mobile threats are created each day, with higher levels of sophistication and larger success rates. Mobile adware, a form of malware designed to display unwanted advertisements on a user’s screen, is utilised by cybercriminals to execute sixth-generation cyberattacks.’”
Adware is like a plague, because it can secretly be downloaded onto a phone and collect a user’s personal information from location to banking information. Adware is designed to sneak onto a phone and deleting it is harder than finding an X on an annoying ad. Adware sneaks onto mobiles devices through applications, usually through a device’s specific store.
It is smart advice to not download third party apps from unverified companies, especially ones discussed in ads or low download rates. Do not trust anything without researching it first.
Whitney Grace, June 10, 2020
Smartphones: Surveillance Facilitated?
May 22, 2020
A recent study published in the Journal of Marketing suggests we tend to reveal more about ourselves when we communicate through our smartphones than when we are on our desktops. The research was performed at the University of Pennsylvania by Shiri Melumad and Robert Meyer. Scienmag explores the tendency in, “Why Smartphones Are Digital Truth Serum.” We learn:
“For example, Tweets and reviews composed on smartphones are more likely to be written from the perspective of the first person, to disclose negative emotions, and to discuss the writer’s private family and personal friends. Likewise, when consumers receive an online ad that requests personal information (such as phone number and income), they are more likely to provide it when the request is received on their smartphone compared to their desktop or laptop computer.”
But why would we do this? For one thing, users seem to be subconsciously affected by the challenges inherent in using a smaller device:
“[The smaller size] makes viewing and creating content generally more difficult compared with desktop computers. Because of this difficulty, when writing or responding on a smartphone, a person tends to narrowly focus on completing the task and become less cognizant of external factors that would normally inhibit self-disclosure, such as concerns about what others would do with the information.”
Then there is the fact that most of us keep our phones on our person or near us constantly—they have become a modern comfort item (or “adult pacifiers,” as Melumad puts it). The article explains:
“The downstream effect of those feelings shows itself when people are more willing to disclose feelings to a close friend compared to a stranger or open up to a therapist in a comfortable rather than uncomfortable setting. As Meyer says, ‘Similarly, when writing on our phones, we tend to feel that we are in a comfortable “safe zone.” As a consequence, we are more willing to open up about ourselves.’”
The researchers analyzed thousands of social media posts and online reviews, responses to web ads, and controlled laboratory studies using both natural-language processing and human analysts. They also examined responses to nearly 20,000 “call to action” web ads that asked users for private info—such ads deployed on smartphones were consistently more successful at raking in personal data than those aimed at PCs. So consumers beware—do not give in to the tendency get too chummy with those on the other end of your phone just because you are comfortable with the phone itself.
Cynthia Murrell, May 22, 2020
Google Apple Contact Tracing Interface
May 9, 2020
Now Toronto published “Here’s What Apple and Google’s COVID-19 Contact Tracing App Looks Like.” The article includes sample screenshots and some explanation about the data displayed. Worth a look. Much more is possible in terms of tracking, contact mapping, and analytics, of course. Who or what will have access to these more useful views of the collected data?
Stephen E Arnold, May 9, 2020
Cambridge Analytica Alum: Social Media Is Like Bad, You Know
April 4, 2020
A voice of (in)experience describes how tech companies can be dangerous when left unchecked. Channel News Asia reports, “Tech Must Be Regulated Like Tobacco, says Cambridge Analytica Whistleblower.” Christopher Wylie is the data scientist who exposed Cambridge Analytica’s use of Facebook data to manipulate the 2016 presidential election, among others. He declares society has yet to learn the lesson of that scandal. Yes, Facebook was fined a substantial sum, but it and other tech giants continue to operate with little to no oversight. The article states:
“Wylie details in his book how personality profiles mined from Facebook were weaponised to ‘radicalise’ individuals through psychographic profiling and targeting techniques. So great is their potential power over society and people’s lives that tech professionals need to be subject to the same codes of ethics as doctors and lawyers, he told AFP as his book was published in France. ‘Profiling work that we were doing to look at who was most vulnerable to being radicalised … was used to identify people in the US who were susceptible to radicalisation so that they could be encouraged and catalysed on that path,’ he said. ‘You are being intentionally monitored so that your unique biases, your anxieties, your weaknesses, your needs, your desires can be quantified in such a way that a company can seek to exploit that for profit,’ said the 30-year-old. Wylie, who blew the whistle to British newspaper, The Guardian, in Mar 2018, said at least people now realise how powerful data can be.”
As in any industry, tech companies are made up of humans, some of whom are willing to put money over morality. And as in other consequential industries like construction, engineering, medicine, and law, Wylie argues, regulations are required to protect consumers from that which they do not understand.
Cynthia Murrell, April 4, 2020
NSO: Back in the News Again
April 3, 2020
Let’s assume that the Beeb is on the money. “Coronavirus: Israeli Spyware Firm Pitches to Be Covid 19 Saviors” is a bit of British snark. First, the word “coronavirus” is newsy, and it is clickbait. Second, “Israeli spyware pitches” converts the use of specialized software into a carnival barker’s shout. (One might ask, “Why?” I think I know the answer. The British Cervantes is on the gallop perhaps?)
The point of the story which contains some loaded words like “controversial” is that NSO has technology which can assist governments in gathering useful information about the virus. The write up states after the Beeb explains that Facebook and NSO are in a legal wrestling match:
NSO says its employees will not have access to any data, but its software will work best if a government asks local mobile phone operators to provide the records of every subscriber in the country. Each person known to be infected with Covid-19 could then be tracked, with the people they had met and the places they had visited, even before showing symptoms, plotted on a map.
Scary, ominous, Orwellian, something that British government agencies would never, ever in a million years consider.
The reality is that monitoring a population is happening in quite a few countries. Perhaps even merrie olde Land of the Angles?
A news story is okay. Shading the coverage to advance the agenda “NSO is just not such a fine piece of British wool” is unsettling — possibly more so than specialized service firms’ software.
Stephen E Arnold, April 3, 2020
Google Android: Simple Explanations Ring True
February 14, 2020
I read “Why Google Did Android.” The author of the article is Tim Bray (OpenText, Sun Micro, Google, etc.) The answer in the write up is:
“The iPhone is really good. The way things are going, Apple’s going to have a monopoly on Internet-capable mobile devices. That means they’ll be the gatekeepers for everything, including advertising, saying who can and can’t, setting prices, taking a cut. That’s an existential threat to Google. Android doesn’t have to win, to win. It just has to get enough market so there’s a diverse and competitive mobile-advertising market.”
The person providing the answer is from Vic Gundotra, former Googler and now ex CEO of AliveCor.
The answer suggests to me that Google wanted to go from A to B in a pragmatic way. That’s what Google engineers try to do: Be pragmatic, logical.
Does this suggest that using Java was the logical way to make the journey from fear of the iPhone to Android? Maybe Oracle’s dogged pursuit of a legal resolution is more than a matter of principle? What’s the catchphrase about asking for forgiveness?
Stephen E Arnold, February 14, 2020
Acronym Shadow: Good Enough Presages the Future of US Technical Capabilities
February 6, 2020
Apps are nothing but drag and drop programming. The database stuff? A no brainer for Shadow. What other half informed generalizations contributed to the technical, managerial, and political issues with the Iowa caucus app. The New York Times, definitely a paragon of technical acumen, analyzed the situation. Navigate to “The App That Broke the Iowa Caucus.” Remember the NYT was the outfit that fumbled its original online play, ably directed my Jeff Pemberton—what, 40 years ago?—and then lost revenue by pulling its “exclusive” from the LexisNexis service a few years later. Now the NYT is a techno master, happily pointing out that failure took place.
There was no mini failure. Maybe some underhanded activity, maybe some carelessness, and maybe some “we’re experts and know what to do” thinking going on.
DarkCyber believes that the misstep, if that’s what it was, was a reminder that technical expertise and excellence are not as easy as writing a proposal, pulling some influence strings, or assuming that code actually works in the real world.
Nope, the good enough approach is operating.
But the larger message is that if the US expects to maintain a place among technology leaders, a different mind set is needed.
What is that mind set? For starters, big thinkers and MBA types must recognize that planning, attention to detail, quality checks, live tests, and making software usable are necessary.
A failure in a core democratic process is a signpost. For anyone who believes the baloney manufactured about artificial intelligence, natural language processing, and advanced analytics—good enough is not.
Is this a bright signal that American technologists cannot deliver when it matters and when those who seek to disrupt America are getting the clown show of a lifetime.
Stephen E Arnold, February 5, 2020
About the Bezos Mobile Matter: Who Can Speculate? Everyone
January 22, 2020
I received a couple of communications about the mobile phone allegedly operated by Jeff Bezos, a tireless worker and high profile wealthy genius. A British newspaper suggested that Mr. Bezos’s mobile was compromised. Then the ever reliable Internet began passing along the story. A few moments ago (it is now 0704 am US Eastern on January 22, 2020) I spotted “Saudi Dismisses Reports It Is Behind Hacking of Amazon Boss Bezos’ Phone.”
The write up states:
“Recent media reports that suggest the Kingdom is behind a hacking of Mr Jeff Bezos’ phone are absurd. We call for an investigation on these claims so that we can have all the facts out,” Saudi’s US embassy said in a message posted on Twitter.
First, how many countries’ intelligence agencies have access to specialized software tuned to compromise a mobile device? The correct answer is, “No one is supposed to know.” DarkCyber estimates that specialized tools are available to many countries. Some using software from Europe; others using software from the East; and others relying on basement methods. Zerodium pays for mobile exploits for a reason. Companies like NSO Group want to maintain a low profile for a reason. IBM does not talk about the CyberTap technology it acquired years ago. The list could be expanded, but you will have to attend one of my law enforcement and intelligence lectures to get more information.
Second, how easy is it to spoof one mobile for another? Not as easy as performing other interesting acts. However, there are companies providing a range of hardware and software tools to make this type of spoofing possible. If you want the names of these outfits, that information will not appear in a free blog post. But these outfits are doing business and providing certain unique services. The customers are usually governments, but friends of friends are a reality. Where can these spoofs take place? Think in terms of a coffee shop or a communications control facility.
Third, who did it? The list of possible actors is long. With Amazon’s increasing success in Bahrain, Saudi Arabia, and United Arab Emirates, there are a number of possibles. Would one of these countries attempt to access Mr. Bezos’ mobile? DarkCyber suggests having some facts before disseminating allegations. Certain types of chatter can have interesting downstream consequences; for example, Mr. Snowden’s ability to enjoy the weather in the south of France and Mr. Greenwald’s interactions with the current Brazilian authorities.
Several observations:
- The message is that mobiles are targets
- A high profile individual can be made the center of an international media magnet
- Work is needed to work backwards to determine if a compromise took place, who did it, and why?
In the meantime, there are security gaps everywhere. S3 buckets expose information. Complex systems generate vulnerabilities. Assumptions about cyber access are often wrong.
Where was Amazon’s chief technology officer? At Mr. Bezos’ side? Probably not. That individual was grilling a Facebook executive about access to personal data in Germany.
Perhaps someone is sending a message to Amazon? Who is paying attention? Probably journalists, high profile mobile phone users, and individuals with leverageable information.
Stephen E Arnold, January 22, 2020
BOB: A Blockchain Phone
November 29, 2019
Remember the comment by some FBI officials about going dark. The darkness is now spreading. “Meet BOB, World’s First Modular Blockchain-Powered Smartphone” reports that a crypto currency centric phone may become more widely available.
The write up states:
BOB runs on Function X OS, which is an open-source operating system. As it uses the blockchain ecosystem, every task on the phone, be it sending texts, making calls, browsing the web, and file sharing, all happen on a decentralized network, making it highly encrypted and thus secure. Each unit of the BOB is a node that supports the entire Function X blockchain system.
DarkCyber thinks that Mr. Comey was anticipating these types of devices as well as thinking about Facebook’s encrypted message systems.
For more details, consult the TechRadar article.
One important point: The BOB has a headphone jack. Even those concerned about privacy and secrecy like their tunes.
Stephen E Arnold, November 29, 2019
Remounting the Pegasus Named NSO
November 15, 2019
Those who care about security will want to check out the article, “Pegasus Spyware: All You Need to Know” from the Deccan Herald. Approximately 1,400 smartphones belonging to activists, lawyers, and journalists across four continents suffered cyber attacks that exploited a WhatsApp vulnerability, according to a statement from that company. They say the attacks used the Pegasus software made by (in)famous spyware maker NSO Group. Though the Israeli spyware firm insists only licensed government intelligence and law enforcement agencies use their products, WhatsApp remains unconvinced; the messaging platform is now suing NSO over this.
The article gives a little history on Pegasus and the investigation Citizen Lab and Lookout Security undertook in 2016. We learn the spyware takes two approaches to hacking into a device. The first relies on a familiar technique: phishing. The second, and much scarier, was not a practical threat until now. Writer David Binod Shrestha reports:
“The zero-click vector is far more insidious as it does not require the target user to click or open a link. Until the WhatsApp case, no example of this was seen in real-world usage. Zero-click vectors generally function via push messages that automatically load links within the SMS. Since a lot of recent phones can disable or block push messages, a workaround has evidently been developed. WhatsApp, in its official statement, revealed that a vulnerability in their voice call function was exploited, which allowed for ‘remote code execution via specially crafted series of packets sent to a target phone number.’ Basically, the phones were infected via an incoming call, which even when ignored, would install Pegasus on the device. The data packets containing the spyware code were carried via the internet connection and a small backdoor for its installation was immediately opened when the phone rang. The call would then be deleted from the log, removing any visible trace of infection. The only way you will know if your phone has been infected in the recent attacks is once WhatsApp notifies you via a message on the platform.”
Pegasus itself targets iPhones, but Android users are not immune; a version Google has called Chrysaor focuses on Android. Both versions immediately compromise nearly all the phone’s data (like personal data and passwords) and give hackers access to the mike and camera, live GPS location, keystroke logging, and phone calls. According to the Financial Times, the latest version of Pegasus can also access cloud-based accounts and bypass two-factor authentication. Perhaps most unnerving is the fact that all this activity is undetectable by the user. See the article for details on the spyware’s self-destruct mechanism.
Shrestha shares a list of suggestions for avoiding a Pegasus attack. They are oft-prescribed precautions, but they bear repeating:
“*Never open links or download or open files sent from an unknown source
*Switch off push SMS messages in your device settings
*If you own an iPhone, do not jailbreak it yourself to get around restrictions
*Always install software updates and patches on time
*Turn off Wi-Fi, Bluetooth and locations services when not in use
*Encrypt any sensitive data located on your phone
*Periodically back up your files to a physical storage
*Do not blindly approve app permission requests”
For those who do fall victim to Pegasus, Citizen Lab suggests these remedies—they should delink their cloud accounts, replace their device altogether, change all their passwords, and take security more seriously on the new device. Ouch! Best avoid the attacks altogether.
Cynthia Murrell, November 15, 2019
-
- Subscribe to Beyond Search
Feature archive
News archive
-
