Hacking, Security & Privacy News - Page 91

Bogdan Alecu, a system administrator at Dutch IT services company, Levi9, has discovered an issue that leaves Google Nexus devices open to DDoS attacks that would reboot the smartphone, or fail to connect to mobile Internet services.

Alecu discovered the issue in all Android 4.x firmware versions of Google's Nexus, Nexus 4 and Nexus 5 smartphones. If a Nexus smartphone was to receive the message, it would display itself on top of every other active window, and is surrounded by a semi-transparent black overlay that has a dimming effect on the screen. If this message isn't saved, or dismissed, a second message is received, which is placed on top of the first message, and the dimming effect continues.

These messages will hit the Nexus phones without a notification, so if they're being sent when you're asleep, or the phone is in your pocket, you'll be none the wiser. Most of the time, Alecu says the phone will reboot, and if a PIN is required to unlock the SIM card, the phone won't connect back to the network for hours. During this time, the phone is useless, as it is unable to receive messages, phone calls, or any other notifications.

According to some documents supplied to the Washington Post by Edward Snowden, Google and Yahoo data centers across the world are intercepted directly by the NSA and GCHQ. The program is known as "Muscular" and can tap into the main communications link that connect Google and Yahoo data centers.

A documented dating back to January 9, 2013 says that the NSA captured millions of records from the search giants each and every day, sending them to NSA data warehouses. Within a 30-day period, over 180 million records were collected, all of which included metadata, text communications, audio and video, too.

The Washington Post did say that the NSA doesn't keep everything, which should help you sleep at night (so much sarcasm intended). Both search giants maintain multiple data centers around the world for redundancy reasons, with data shared between the data centers all the time. Google has said that it was not aware of the NSA activity, with a Yahoo spokesperson saying that it has strict controls in place to protect the security of their data centers, and that it has not given the NSA or anyone else access to their data centers.

Most are impressed with the NSA's Apple's TouchID fingerprint scanner, being the only real change on the iPhone 5S, but hacking collective Anonymous has come out with quite the claim: the US government is using the TouchID database to collect citizens' fingerprints.

Anonymous has released a video, above, with several documents supporting its claim. Anonymous claims to have uncovered evidence of a "corrupt alliance" between the US government and a bunch of its contractors. AuthenTec, the company who made Apple's TouchID technology, reportedly has strong ties to "the most powerful and corrupt Defense Department and Intelligence Community contractors and figures." This is an interesting quote from the piece:

In brief, the claims the group make concerning Touch ID seem to focus on Authentec director, Robert E Grady, who appears to have been a prominent figure within the George Bush administration and (Anonymous claim) was connected with The Carlyle Group, which Anonymous also claim is a majority shareholder in Booz Allen Hamilton, the NSA contractor with which whistleblower Edward Snowden worked.

Caspar Bowden worked for Microsoft between 2002 and 2011 as its Chief Privacy Adviser, but now says he doesn't trust Microsoft's security after he read the stories about the NSA PRISM system after NSA whistleblower Edward Snowden stepped up with the leaks.

Bowden was in control of the privacy policy for 40 countries that Microsoft operated in, but strangely he didn't have anything to do with the United States side of Microsoft's privacy. Bowden says he was simply unaware of the PRISM data-sharing network when he was with the software giant. He said "I don't trust Microsoft now," where he added that he now uses open source software that allows him to peer into the underlying code.

The former privacy adviser to Microsoft said that the NSA PRISM system was undermining democracy by sharing citizens' private information with the UK's GCHQ and intelligence agencies in Australia, New Zealand and Canada. He added: "The public now has to think about the fact that anybody in public life, or person in a position of influence in government, business or bureaucracy, now is thinking about what the NSA knows about them. So how can we trust that the decisions that they make are objective and that they aren't changing the decisions that they make to protect their career? That strikes at any system of representative government."

John McAfee, modern day eccentric millionaire and founder of McAfee Antivirus, announced over the weekend that he has devised a plan to block the illegal--and legal--spying from the NSA once and for all. McAfee outlined his plan on Saturday while speaking at an event in San Jose, California.

The big plan involves a device created by McAfee which he calls "D-Central." The gadget is essentially a wireless networking hub that allows smartphones, tablets, laptops, and any other Wi-Fi connected device to access what is basically a darkweb-like network that blocks mainstream intrusion from the government. The D-Central device would retail for $100 or less and McAfee says that he has been planning the device for several years now.

D-Central will provide not only a private (darkweb) connection, but will provide a public one as well and can be used to share files, chat, and research without ever unveiling your identity. McAfee said that the device has a range of about three blocks, and at the moment D-Central "is round in shape" and features "no screens". A working prototype is said to be just six months away and McAfee is actively searching for partners to help with development. Anyone looking for more information can hit up the source below to check out the official D-Central website.

Dropbox has jumped onto the transparency bandwagon with fellow tech giants such as Google, Microsoft, Twitter, and Facebook. Today, Dropbox announced that it has filed an amicus brief with the Foreign Intelligence Surveillance Court.

The brief requests that the court give permission to all Internet companies to disclose all requests for information regarding their users when it comes to matters of national security. This would allow Dropbox to publish a list of every information request it has received regarding its users from governments both foreign and domestic.

Dropbox says that "the Court should not permit the government to invoke the mere label of 'national security' to justify the speech restraints it seeks." Currently tech companies can publish how many requests they received, but only on non-gag law enforcement requests, and can only disclose a vague number range when dealing with national security requests.

On September 11 of all days, a new leak from Edward Snowden has appeared online thanks to The Guardian, which reports that the NSA shares raw intelligence data with Israel without sifting through it first.

Snowden revealed the startling news, with an intelligence-sharing agreement detailed in a memorandum of understanding between the US spy agency and its Israel counterpart. This has unveiled that the NSA hands over intercepted communications that would contain American citizens' phone call records and e-mails (and most likely much, much more). The agreement between the spy agencies has no legally binding limits on the use of the data by the Israelis.

The deal was inked back in March 2009, with the agreement between the US and Israeli spy agencies "pertaining to the protection of US persons" repeatedly stressing the constitutional rights of Americans to privacy, as well as the need for Israeli intelligence staff to 'respect these rights.' The agreement saw the Israeli spy agency with "raw Sigint", which is signal intelligence.

Der Spiegel is at it again, reporting that it has NSA documents in its hands that state that the US spy agency accessed data from Apple iPhones, BlackBerry devices and Android-based devices.

Der Spigel stated that most smartphone data can be accessed, including users' contact lists, text message logs and information on geographical locations. The NSA has set up working parties that makes sure each of the main mobile OS' had a "back door" that was accessible to spies. This has stirred memories in Germany, where the paper is based, of the Nazis and the communist era from decades ago.

The one company that has the most at stake would be BlackBerry, who has proudly sold devices on the fact that they the encryption in them is too strong for anyone to crack. Google and Apple, we both know have worked with the NSA previously, so this news should come as a shock to no one. This news also comes on the heels of our latest report where we talked about common encryption protocols were nothing for the NSA.

Today, Facebook revealed that the US government accounts for the vast majority of the requests for information it receives about its subscribers. The social network said that it was legally required to comply with 79 percent of the 12,000 requests it received from the US government about 21,000 individuals who have profiles on the website.

The US government is not the only guilty party though, as the UK government submitted about 2000 requests on over 2300 Facebook users, which it was obligated to turn over 68 percent of the requests. On the lower-end of the spectrum, Australia requested info on 601 users, of which 64 percent were granted. Facebook chose to release this information in an effort to be transparent after accusations of being close partners with the NSA in the infamous PRISM scandal.

In a blog post, Facebook's general counsel, Colin Stretch, wrote: "As we have made clear in recent weeks, we have stringent processes in place to handle all government data requests... We believe this process protects the data of the people who use our service, and requires governments to meet a very high legal bar with each individual request in order to receive any information about any of our users."

Early Sunday morning, the Chinese government says that it faced what is described as the largest Direct Denial of Service (DDoS) attack that the country has ever seen. The attackers targeted China's Top Level Domain (TLD) .cn and effectively took down all Chinese websites using the .cn TLD.

China's Internet Network Information Center said that the attacks began around 2 AM early Sunday morning and lasted for about two hours with the DDoS attack falling off around 4 AM. The Wall Street Journal spoke with web host CloudFlare about the incident and how it affected Internet traffic. It said that there was a 32 percent drop in traffic across all the Chinese domains hosted on its network during the attack. "It is not necessarily correct to infer that the attacker in this case had a significant amount of technical sophistication or resources," CloudFlare CEO Matthew Prince wrote to the Journal. "It may have well have been a single individual."

At the moment, Chinese officials and industry analysts are not sure why the attacks occurred or if there was a specific target they were hoping to take down. With the attacks lasting only two hours, not much damage occurred, but we've seen this sort of thing in the past with short attack serving as a way to test the waters for a much larger future attack. In 2013, China has come under several major cyber attacks but has also led several cyber attack campaigns itself.