A Grab Bag

Scammers Work Around Two-Factor Authentication With Social Engineering

http://it.slashdot.org/story/11/12/06/0321250/scammers-work-around-two-factor-authentication-with-social-engineering

Download.com Bundling Adware With Free Software

http://news.slashdot.org/story/11/12/06/014244/downloadcom-bundling-adware-with-free-software

Apple to Samsung: Don't Make Thin or Rectangular Tablets or Smartphones

Apple says, essentially, that you can't make a smartphone or tablet.

http://apple.slashdot.org/story/11/12/05/2143245/how-to-avoid-infringing-on-apples-patents

http://www.pcworld.com/article/245493/apple_to_samsung_dont_make_thin_or_rectangular_tablets_or_smartphones.html

Digital Face-Swapping Getting Cheaper

In other words, get ready for photographic evidence that can be fabricated to suit any thesis.

http://www.eecs.harvard.edu/~dale/docs/faceReplace_sa2011.pdf

Multi-Target Photo-Radar System To Make Speeding Riskier

Watches four lanes at once, 32 vehicles at once, records speed and license plate.

http://tech.slashdot.org/story/11/10/31/1846223/multi-target-photo-radar-system-to-make-speeding-riskier

http://www.peakgainsystems.com/en/cordon.html

DARPA to detail program that radically alters security authentication techniques

Going beyond passwords.

http://www.networkworld.com/community/blog/darpa-detail-program-radically-alters-securit

FBI takes out $14M DNS malware operation

http://www.networkworld.com/community/blog/fbi-takes-out-14m-dns-malware-operation

DARPA gets serious with Internet security, schmoozes the dark side

Describes the DARPA Cyber Analytic Framework, and points out that most exploits average only about 125 lines of code.

http://www.networkworld.com/news/2011/110811-darpa-internet-security-252896.html?hpg1=bn

Creepy Keepers of the Keys

The arguments for surveillance generally are about catching more crooks. The arguments against are that the practitioners of surveillance cannot be trusted; that they will break the laws themselves, and then use their privileged access to avoid punishment. At this point, I'd almost write "well, duh!" But then I can't count the number of times I've seen some comment posted on an article where the writer is voting for more surveillance without a whisper of concern for the "who watches the watchers" problem.

IT Pros Can't Resist Peeking At Privileged Info

26% of IT staff admit to using their privileges to view confidential data. That is the percentage that would admit to it.

http://yro.slashdot.org/story/11/12/05/1530240/it-pros-cant-resist-peeking-at-privileged-info

http://www.net-security.org/secworld.php?id=12048

GCreep: Google Engineer Stalked Teens, Spied on Chats

A Google staffer, no less, with the mission to "not be evil" was nevertheless. Quote: "...SREs are given unfettered access to users' accounts for the services they oversee..."

http://gawker.com/5637234/

Government Spying on Itself

Usually this kind of article (if found on someplace other than IOAI) would have a link about some nefarious Government plot to read our emails. And maybe that will show up in the future, but this time, the paranoids out there in media land goofed(!):

New US Government Project To Monitor Electronic Communication

http://yro.slashdot.org/story/11/12/05/1511239/new-us-government-project-to-monitor-electronic-communication

COULD THE U.S. GOVERNMENT START READING YOUR EMAILS?

http://news.discovery.com/tech/government-reading-emails-privacy-111203.html

These articles are reporting on PRODIGAL, which is created by Georgia Tech for the U.S. Government. What's lost during the fireworks and outrage, however, is that PRODIGAL is designed to spy on internal Government computer networks. This is an actual case, if the story is correct, of an informational organization seeking to reinforce probity through active surveillance of itself. In other words, this is a mole-catcher. And the media reports are badly inaccurate in tone.

Moral: Not everything about privacy and surveillance is gloom and doom. The PRODIGAL story is not exactly a lullaby that will help you sleep better, but it is a step forward and upward.

Facebook Keeps Shadow Profiles on Non-Users

This article started out as a report on the supposed shadow profiles that Facebook keeps on non-users. The arc of the story is clear: Some people choose not to have Facebook accounts because they don't trust the company or its web site, but if Facebook keeps secret data caches on non-users then it is up to something more than just providing a service. Here are some of the stories:

Facebook Is Building Shadow Profiles of Non-Users

http://yro.slashdot.org/story/11/10/18/1429223/facebook-is-building-shadow-profiles-of-non-users

and the actual document of the complaint:

http://europe-v-facebook.org/Compalint_02_Shadow_Profiles.pdf

Facebook Building 'Shadow Profiles' of Non-Members, Experts Allege

http://www.foxnews.com/scitech/2011/10/21/facebook-building-shadow-profiles-non-members-experts-allege/

Facebook is 'building shadow profiles of NON-users', says complaint to privacy watchdog

http://www.dailymail.co.uk/sciencetech/article-2052500/Facebook-building-shadow-profiles-non-users-claims-privacy-watchdog.html

[Whoops, that was two Murdoch links back to back. Here is an independent voice.]

Facebook Ireland accused of creating 'shadow profiles' on users, nonusers

http://news.cnet.com/8301-1023_3-20123919-93/facebook-ireland-accused-of-creating-shadow-profiles-on-users-nonusers/

Of course, Facebook says that it is not keeping profiles of non-users. It does admit to keeping names and emails and linking them to people who are users.

Facebook denies “Shadow Profile” claims; Risks €100k privacy fine

http://www.slashgear.com/facebook-denies-shadow-profile-claims-risks-e100k-privacy-fine-24190251/

I started thinking about Facebook's claim. If they only keep name and email, that is more than most us would like, but it could be a lot less than all the rest of these background investigation sites have:

pipl.com

www.intelius.com

www.spokeo.com

www.peoplefinders.com

www.anywho.com

www.whowhere.com

www.zabasearch.com

www.peoplesmart.com

www.beenverified.com

backgroundsearch.com

www.peoplerecords.com

www.backgroundpi.com

www.snoopstation.com

Every single one of these sites keeps a "shadow profile" on millions of people. So is Facebook any worse? Or should we be just as alarmed at spokeo or pipl or snoopstation?

One thing that is different is that Facebook keeps social network data. Spokeo may not have any links data connecting Smith with Johnson. Or they might. But we know for sure that Facebook does, and that its plans for using network data are more sophisticated than what we've seen from the public records publishers in the past.

Background on backgrounds: http://en.wikipedia.org/wiki/Background_check

CarrierIQ: The Saga So Far

What keeps this blog hopping is that there are so many violations of privacy expectations these days. That means I can barely keep up, and you can read about the details from many other sources that have better information than I do. Here is my collection of articles and links about Carrier IQ and its spat with the cell-phone-using public.

Background: Trevor Eckhart discovered a piece of software (a rootkit?) installed on many Android, Blackberry, and Nokia cell phones that records keystrokes(?) and records just about everything that happens on that phone. When this news became public, Carrier IQ issued a cease-and-desist letter to Eckhart. The tech-savvy community took this as confirmation that everything Carrier IQ was accused of doing was true.

Carrier IQ: Most Phones Ship With "Rootkit" (11/16/11)

http://yro.slashdot.org/story/11/11/16/1517248/carrieriq-most-phones-ship-with-rootkit

Carrier IQ Tries To Silence Security Researcher (11/22/11)

http://mobile.slashdot.org/story/11/11/23/0032233/carrieriq-tries-to-silence-security-researcher

Cease and Desist Letter Sent to Eckhart by Carrier IQ (11/16/11)

https://www.eff.org/sites/default/files/eckhart_cease_desist_demand_redacted.pdf

More on Carrier IQ (11/15/11)

Analyzes and extrapolates on the emerging data, pointing out that phone company employees would then have extremely good intell that could be used for home invasions.

http://www.xda-developers.com/android/more-on-carrier-iq/

Carrier IQ Relents, Apologizes (11/24/11)

http://yro.slashdot.org/story/11/11/24/1852213/carrier-iq-relents-apologizes

Their press release (11/23/11):

http://www.carrieriq.com/company/PR.EckhartStatement.pdf

http://www.theverge.com/2011/11/23/2583862/carrier-iq-retracts-cease-and-desist-letter-sent-to-xda-developers

How Carrier IQ was wrongly accused of keylogging (12/2/11)

http://news.cnet.com/8301-31921_3-57335715-281/how-carrier-iq-was-wrongly-accused-of-keylogging/

Carrier IQ Drama Continues (12/3/11)

http://yro.slashdot.org/story/11/12/03/2112220/carrier-iq-drama-continues

So what's going on? Carrier IQ has pointed out that if anyone is recording anything, it is the carriers, who have control over the data stream.

Interestingly, in the CNET article above, they say "...AT&T's statement, which merely says that Carrier IQ is used in accordance with the company's privacy policies." To me, this sounds like a paper wall between the public and spooky surveillance. What AT&T is really saying is, "we don't look at unless the Federal government shows up and tells us to give your data to them."

Just Plain Spooky - A Links Collection

Feds Warrantlessly Tracking Americans’ Credit Cards in Real Time

This is about a year old. The Wired site has a full DOJ PowerPoint presentation. Aside from being spooky, this is a problem when fitted together with the "all data spills" concept. That is, if we assume that Fed personnel are human, and therefore subject to little side deals and payments, then this data leaks out to "unnamed third parties" continually.

http://www.wired.com/threatlevel/2010/12/realtime/

Canon blocks copy jobs by keyword

Using OCR, plus I assume other means, Canon's Uniflow 5 system can read the content of documents being scanned, printed, and copied and record the existence of trigger words or even block specific functions.

http://www.itnews.com.au/News/235047,canon-blocks-copy-jobs-by-keyword.aspx

Cookies on Your Computer That Last Forever

Hackers have been working on making tracking cookies that cannot be deleted. This is a holy grail goal for both marketeers and spy agencies. (No difference!) Warning: If you go to this URL, they may place a tracking cookie on your browser (and computer) that you may not be able to get rid of.

http://samy.pl/evercookie/

'Pre-crime' Comes to the HR Dept

A company called Social Intelligence is scraping your Facebook, MySpace, Google+, LinkedIn and other posts and building a case file that will be sold to companies that want to judge whether you will be a fit employee.

http://itmanagement.earthweb.com/features/article.php/3905931/Pre-crime-Comes-to-the-HR-Dept.htm

Black duck eggs and other secrets of Chinese hackers

Plain old industrial espionage, yum yum. I think this is pretty much the epitome of the undeniable tell. China, you can't deny that black duck eggs would be available in that tiny town! Dead give away!

http://www.networkworld.com/community/blog/black-duck-eggs-and-other-secrets-chinese-hac

Full-Body Scan Technology Deployed In Street-Roving Vans

American Science & Engineering, based in Billerica, Massachusetts, makes the Z Backscatter Vans ("ZBV") that can be used on any road and used to peer through building walls. (I wonder what the medically-indicated maximum dose of X-ray radiation from these things is? How long until the surveillance is so regular that cancer rates go up?)

http://www.forbes.com/sites/andygreenberg/2010/08/24/full-body-scan-technology-deployed-in-street-roving-vans/

Malls Are Tracking Your Cell Phone

Malls in the U.S. have installed systems that track shoppers by their cell phones. Customer movement data is then shared with retailers in the mall.

http://arstechnica.com/business/news/2011/11/were-watching-malls-track-shoppers-cell-phone-signals-to-gather-marketing-data.ars

Although the official explanation of the system claims that the data is anonymous, there are many ways to attach names to the data, including use of face recognition software that malls and retailers also have installed.

Imagining an Open Source Eye in the Sky

In the past, intelligence agencies had the tough job of collecting and aggregating data fast enough and with sufficient relevance that they could have an impact on the decisions regarding the targets of their collection. With the advent of computers, all of that correlation and cross-referencing got a lot easier. With the internet, data sources became enriched, and with modern software and hardware systems, the interfaces to that data have become more natural and powerful.

Businessweek has written about Palantir, a system that aggregates data for anti-terror surveillance.

http://www.businessweek.com/printer/magazine/palantir-the-vanguard-of-cyberterror-security-11222011.html

The history of computers has shown that computing capacity always grows to the point that what used to be affordable to only major corporations becomes affordable to individuals. Today we carry around smart phones with the processing power that entire mainframes possessed in the 1970s. Desktop computers in 2011 have more power than supercomputers of the 1980s.

In addition, the open source world has proven that it can generate powerful software that supplants, replaces, or exceeds commercial applications. Where there is Matlab, there is also Octave. For Excel, there is OpenOffice. For Oracle, there is MySQL.

The next logical step is for open source data aggregation software with capabilities like those inside the three-letter agencies in the U.S., but used and operated by individuals or small organizations. A crowd-sourced intelligence net could field an enormous number of sensors. Most of the pieces of the software have other uses, so it is unlikely that development would be halted from lack of interest. And there are certainly enough people who want surveillance abilities of their own that the audience for this kind of software system exists.

When? Perhaps by 2015. Certain pieces will emerge in 2012. The capabilities for aggregation will grow a bit at a time, with data sockets for spill sources like Facebook, AOL, and Google+.

At the natural maturation point, the open-source software for surveillance data aggregation will match in quality and capability what is supplied to the Government by contractors.