Security Through Absurdity

The Mysterious Permissions of Bejeweled 2

2012-01-05T14:49:00.000-08:00

Bejeweled is a very popular game introduced by PopCap Gameswhich was recently acquired by Electronic Arts. The addicting game can be foundon almost every platform that supports gaming from personal entertainmentsystems on airplanes (my wife and I killed 8 hours on a flight from Tokyo toSeattle that way), to the PC, to gaming consoles, and as I discovered, onAndroid phones as well.

When I bought my T-Mobile HTC MyTouch 4G Slide I startedlooking at the pre-installed software and I was startled when I saw that thedemo version of Bejeweled 2 that comes pre-installed on the device had beengranted permissions that would allow for the most egregious forms of spyware.The demo game takes permissions that are far in excess of those required by thepaid version, and completely unreasonable for the game to have. I understandthe concept of a free game that is paid for by advertising and that in thismodel some personal information is going to be transmitted back to a thirdparty, however, the Bejeweled 2 demo is not an advertising paid game, it is acrippled demo version and the permissions it has commandeered are far in excessof what is required for marketing.

By way of comparison, if you go to purchase Bejeweled 2 onthe Android market, the game only requires the following permissions:

Modify/Delete SD card contents

Full Internet Access

Read Phone State and Identity

Prevent phone from Sleeping

The pre-installed demo version of Bejeweled not only co-optsthese permissions but also has taken the following additional permissions:

Read and write contact data

Send SMS messages

Receive SMS messages

Course (network-based) location, fine GPS location

Record Audio

Not only does this demo version of the game co-opt these spywarelike capabilities, but the device owner is never asked to accept this intrusionand the only way to remove the software is to void your warranty (http://randy-abrams.blogspot.com/2011/12/htc-do-you-want-privacy-and-security-or.html).

According to HTC, they can’t remove the software becausethey have an agreement with T-Mobile. If T-Mobile agreed to let them remove it,they might, but it isn’t assured. Wondering why the game requires such invasivepermissions I contacted Electronic Arts and I must say I am quite impressedwith their open and communicative approach to dealing with people.

According to Electronic Arts, Bejeweled 2 has not beenprogrammed to be able to record audio, send or receive SMS messages, or readand write contact data. The permissions exist, but are not implemented. I wasalso told that EA is actively working to correct the privilege problems with afuture update.

Outside of tedious reverse engineering or having the sourcecode to examine, the only way to know if Bejeweled 2 is spyware is to examinethe traffic flowing in and out of the device. This requires both analysis ofInternet traffic and GSM traffic. Unfortunately this type of analysis is not astandard capability of an Android phone and well beyond the technicalcapabilities of most people. A representative of Electronic Arts has indicatedthat they are not monitoring my SMS’s, accessing my contacts or recording myaudio and I believe them, however given HTC’s track record and the researchfrom North Carolina State university (http://www.csc.ncsu.edu/faculty/jiang/pubs/NDSS12_WOODPECKER.pdf_)the permissions that exist still may present serious privacy and securityproblems. Even if Electronoc Arts issues an update, this does not completelysolve the permissions issue. As long as the update can be uninstalled, which isnormal for updates to pre-installed applications, there is potential formalicious apps to potentially take advantage of the lax permissions, either asthey exist, or by uninstalling the updates.

When first discovered the excessive permissions I seriouslywondered if Bejeweled 2 is spyware. I think it is a safe assumption thatBejeweled 2 is not spyware, but I can’t say that about Facebook for HTC Sense,which cannot be uninstalled and takes even more invasive permissions? Whatabout Flickr or other pre-installed apps?

HTC could issue an uninstaller for pre-installed apps that auser doesn’t want. HTC could present user agreements for each invasive app andremove the app if the user does not agree, but your privacy and security is nottheir business. The same is most likely true of all Android phone manufactures.

According to the representative I corresponded with fromElectronic Arts, the new version of Android “Ice Cream Sandwich” will allowusers to block pre-installed apps and not show their icons. This is a positivestep, but falls short of protecting users and respecting privacy and security.

Randy Abrams

Independent SecurityAnalyst

The Do Not Track Act of 2011 Has Global Implications

2011-12-30T14:27:00.000-08:00

While US senate bill S.913 AKA Do-Not-Track Online Act of2011 may only apply to US companies and citizens, the effects of the bill wouldapply to anyone in the world who accesses certain US based sites. Despite muchstronger online privacy standards in part of Europe than the US has, EU laws donot apply to US web sites with no European presence.

The Do-Not-Track Online Act of 2011 specifies that personal informationwill not be collected unless a person consents to it and that the legislationapplies to mobile application and service providers. With the explosion ofsmartphones, this is a particularly important aspect for US citizens. If passedthe impact on the Android platform would be evolutionary. The entire spywareculture of Google’s Android market would be changed. For US citizens and allothers in the world the requirement that an individual “receives clear,conspicuous, and accurate notice on the collection and use of such information”and that they “affirmatively consents to such collection and use” Is significant.Fundamentally this is “opt in” and would be exactly what the Direct MarketingAssociation (http://www.the-dma.org/cgi/dispannouncements?article=1550)would be rallying for if they actually supported human decency.

The businesses that are against the legislation are willingto spend a lot more money lobbying against the bill than what they believe thecost of compliance would be, so it will be a tough fight. The only way thisbill has a chance of seeing the light of day is if Americans come out en massand tell their representatives to support the bill and if citizens in the restof the world pressure their governments to express strong support for the bill.

This piece of legislation has implications far beyondterritorial boundaries of the United States of America

The text of the Do Not Track Act of 2011 can be found at http://thomas.loc.gov/cgi-bin/query/z?c112:s913:

Randy Abrams

Independent SecurityAnalyst

HTC “Do You Want Privacy and Security or Your Warranty?”

2011-12-30T10:38:00.000-08:00

HTC and other Android phone manufacturers give theircustomers a difficult choice. As an HTC customer you are forced to choosebetween privacy and security or you warranty. HTC installs invasive softwarecapable of sending private information to third parties without your knowledgeor informed consent. The only way to get rid of these potential threats is toroot your device.

A study from North Carolina State University found that theAndroid permissions model is often not properly enforced, especially by HTC.The result is that stock applications can be attacked to exploit theirpermissions. The study can be downloaded at www.csc.ncsu.edu/faculty/jiang/pubs/NDSS12_WOODPECKER.pdf.

For my non-techie friends, what the report basically says isthat if a game on your Android phone can know where you are by using a GPS, thenpotentially a completely different program that doesn’t have the ability to useyour GPS can use your GPS to track you by using the game to help it. If apre-installed application can record your voice and send SMS messages, then amalicious application that looks like a harmless game may be able to sendexpensive SMS messages, or record your phone conversations. The report alsofound that HTC and Samsung don’t appear to really care at all about thesecurity and privacy of their users.

One of the best ways to improve security and privacy can be toremove applications that you do not use. Software has security flaws andprograms that you do not use can still be exploited to allow a criminal toaccess your data, or determine your location. Knowing your location can lead tophysical security problems while accessing your data can lead to identity theftor simply spam that the criminal profits from.

The unfortunate truth is that the only way to remove thesesecurity and privacy threats is to root the phone. Again for my non-techiefiends, rooting an Android phone is like having a cardkey to access a buildingand changing the access permissions so that you can go anywhere in the buildingat all, even into the security control room!

Here’s the problem with rooting your phone… for HTC, andprobably most manufacturers, rooting the phone voids the warranty. As a matterof practice, if you back everything up properly and there is a problem thatdoesn’t completely cripple the device then you can restore the factory settingsand HTC will not know you have done something to void the warranty, but thefact remains that the stance that HTC takes is that if you want to take anyreasonable steps to improve privacy and security on your HTC device they willnot honor the warranty.

As for why you can’t simply remove pre-installedapplications, HTC will blame the carrier, such as T-Mobile and the carrier willblame the manufacturer.

Randy Abrams

Independent SecurityAnalyst

Why So Much Viagra Spam?

2011-12-28T11:18:00.000-08:00

That’s simple.The long and the short of it (sorry about that) is that Viagra spam is theobvious overcompensation of the incurable impotence of Direct MarketingAssociation (DMA). In response to the proposed Do Not Track Online Act of 2011the DMA has issued a limp statement that lacks hard facts http://www.the-dma.org/cgi/dispannouncements?article=1550.

The first sign ofdishonesty is when the DMA issues a press release, but let’s dig into this onejust a little bit. The DMA claims that their self-regulatory program “providesexactly the type of “simple, straightforward way for people to stop companiesfrom tracking their movements online” that Senator Rockefeller called for uponreleasing his bill”. Really? If so then why does the DMA think that the Do NotTrack Act will result in job loss? After all it only does EXACTLY what theirown self-regulatory program does, right?

The DMA’s "self-regulatoryprogram" is a completely useless smoke screen. The program is a complete lie andis entirely ineffective. To start with, the mechanics of the program are based upon ancient technology that the brightestminds at the DMA can’t begin to comprehend. The entire strategy is based uponputting cookies on your computer and the impotent masterminds at the DMA can’teven figure that out. Really, an opt-out page that unsuccessfully attempts todrop a bunch of cookies and is still in beta to do even that (http://www.aboutads.info/choices/)?Seriously, each of their members knows how to successfully write cookies, butthe “organization” can’t get a cookie writing app out of beta and make it work.Not that it would be an intelligent, reasonable, viable, or honest approacheven if it did work as designed.

How well is theself-enforcement working? Well, Between Twitter, Google, and Facebook we have60 years of FTC monitoring due to egregious anti-privacy practices, so eitherthe DMA’s self-regulation is completely useless or these companies aren’t membersand the DMA is completely impotent. I suspect that the DMA’s membership is tinyand they lie about their size :) You have to agree to let the DMA track youbefore you can find out who the members are though as only members can see themembership list.

The DMAmisrepresents the bill as ““The bill would prohibit a company from doingsomething as simple as keeping track of the customers who interact with itonline, making it impossible to provide the kind of customized user experiencethat consumers have come to expect.” What they really mean is that unlike theiruseless program, consent would be required to track people. This is exactlywhat the DMA does not want.

The DMA furtherstates that they are “concerned that legislative proposals regarding theInternet run the risk of undercutting the leading area of American dominanceand job growth.” In other words, privacy invasion is the job sector the DMAseeks to protect.

The DMA appearsto be illiterate as well. They state “Further, the DMA is concerned that thislatest legislative proposal would impose untold regulatory compliance costs onbusinesses without a showing that there is a market failure or a need toregulate”

60 years ofoversight by the FTC for only 3 companies, not to mention a lawsuit against Disney,Ustream, SodaHead, Warner Bros. and others for spying on kids (http://arstechnica.com/tech-policy/news/2010/08/lawsuit-disney-others-spy-on-kids-with-zombie-cookies.ars),plus a brand new lawsuit against Facebook that allege illegal tracking (http://idealab.talkingpointsmemo.com/2011/10/facebook-hit-with-lawsuits-over-timeline-and-tracking.php)and the DMA is too blind to see that there is obvious need for regulation andthere are obvious market failures.

I always thoughtit would be fun to write for the National Enquirer. I admire the creativethought that goes into some of the completely fictional stories, but now Irealize that fictional writing for the likes of the National Enquirer, theWeekly World News, and FOX TV News are simply training for writing a DMA pressrelease.

The DMA lacksanything remotely resembling credibility, and is a monument to self-regulatoryimpotence. If the DMA is opposed to the Do Not Track Act of 2011 you can betthe legislation is in your best interest. If you live in the US I recommend youcontact your local congressional representatives and urge their support for it!

Sorry DMA, Allthe Viagra in the world cannot help your self-regulatory impotence.

Randy Abrams

IndependentSecurity Analyst

Facebook - The Misleading Advertising Platform

2011-12-27T10:49:00.000-08:00

Companies that advertise on Facebook really need to becareful about their strategies. It is no longer enough to consider the messageyou put out to potential customers, you have to think about how Facebook isgoing to co-opt your message. I have already blogged about how Facebook mightpotentially use photos of children to promote booze, sex and tobacco (http://randy-abrams.blogspot.com/2011/12/does-your-kid-like-jack-daniels.html),but the hazards advertisers face are not limited to choices users make abouttheir profile pictures. I’ll give you a case in point. I saw an ad yesterday frommy former employer, ESET.

This looks like a reasonable promotion. There’s marketingvalue in having people “Like your page” and offering an incentive is alegitimate approach. The gotcha is how Facebook might to change themessage.

Let’s assume I have not heard of ESET before, or never triedthe product. It seems like a good time to try a new security solution and Ihave no real energy, positive or negative, around ESET. I “Like” the page andget my free trial. Now here is where things can get bad for a company in ahurry.

My friend sees an ad from ESET that shows my picture andsays I “like” ESET. My friend says to me, I saw your picture next to an ESET adthat says you like them! Are they really good?” If I am like many Facebookusers I will not have been aware that my picture could be used without mypermission, and trying a product is not at all the same thing as liking aproduct. Facebook is translating a desire to test out a security product into amisleading advertising claim. There is potential for a very negative andadverse reaction.

Facebook has adopted an Orwellian double-speak approach withthe word “like” and advertisers should be mindful of the changes to their adsthat Facebook makes when they pair users with advertisers.

Perhaps the incidence of this type of negative response islow enough that the risk/reward ratio merits the approach, but it is a scenariothat companies advertising on Facebook should consider. The word “like” inFacebook context is deliberately misleading and at times definitely conveys afalse impression… and this is by design.

Advertisers on Facebook need to consider how their ad is going to be presented after Facebook adds their spin to it. In time users will probably get used to having their profile picture used without consent or previous knowledge, but until then there could be some bumps in the road for advertisers.

If I have to “like” a page to get the information I want, I don’thave a problem with that, but until Facebook agrees to not use my name andphoto to promote a company’s product if I have simply subscribed to their news feed,I am un-liking all commercial entities.

As I have already told Alaska Airlines and ESET, as soon asFacebook changes their policy so that I have a choice as to where my name andphoto are used in advertising, I’ll come back and “like” you again!

Randy Abrams

Independent Security Analyst

Does your Kid “Like” Jack Daniels, Marlboro’s and Hustler?

2011-12-21T18:13:00.000-08:00

When Facebook makes a decision, they leave users with veryfew options to meaningfully express dissatisfaction with the changes. RecentlyFacebook began rolling out a massively disliked change called “timeline” andthe only effective way I see to protest the change is to hide ads and indicatethat is why you have hidden them (http://randy-abrams.blogspot.com/2011/12/facebook-timeline-or-time-bomb.html)

The latest news is that after much ado to divert yourattention away from long standing plans, Facebook plans to use your kid to advertiseJack Daniels (https://www.facebook.com/jackdaniels),Hustler (https://www.facebook.com/pages/Hustler/104010389635531),Marlboro (https://www.facebook.com/pages/Marlboro-Cigarettes-Brands/112436532109106)and all other manner of product and service. OK, that may be a bit sensationalistic,but nowhere far from realistic. Here’s the scoop (yeah, your kid may like ScoopAway https://www.facebook.com/ScoopAway?ref=tstoo).

Back in 2009 the LA Times reported that Facebook could useyour pictures to advertise product without your permission http://opinion.latimes.com/opinionla/2009/07/facebook-can-use-your-pictures-for-ads-no-permission-required.html).Facebook quickly laid out a scrumptious feast of red herring and told you that thiswasn’t the case (https://www.facebook.com/blog.php?post=110636457130).This was to divert your attention away from the obvious intent that was presenteven back then. It should come as no surprise that Facebook has decided thatyour profile picture will be used without your permission to promote productsand services. It’s in the news here http://www.tntmagazine.com/news/world/facebook-using-your-picture-in-sponsored-stories-from-2012and here http://www.pcmag.com/article2/0,2817,2397889,00.asp

Here’s the thing you need to be careful of… If you use yourchild’s picture for your profile picture, and lots of people do, then it isyour child’s picture that is going to be shown as supporting a product or a service.If as an adult you want to “like” Jack Daniels, Marlboro, and hustler, that isyour choice, but it is probably not what you have in mind for associating yourkids with.

So, how do you protest the impending policy change by Facebook?I am aware of two viable protests. One of the ways to protest is to file suit,and people in California have done just that. http://www.businessweek.com/news/2011-12-21/facebook-lawsuit-against-ads-given-go-ahead-by-u-s-judge.html

The other way to protest is to start un-liking ALL commercialFacebook entities. It is important that you also express why you are un-likingthem.

Here is what I will told Alaska Airlines…

The only way Facebook willlisten to consumers is to hit them in the advertisement.

It can be a little tricky tounnlike a page. Facebook tries to hide that form you. You need to go to thepage and then scroll down to the bottom of the ledt ahnd column where you willfind an “unlike” link. Facebook makes the “like” link prominent, but attemptsto thwart user choice by making it much harder to find out how to “unlike” apage.

I must go now and unlike allcommercial entities on Facebook until Facebook makes it prudent to “like” suchentities.

If oyu use a picture of yourchild for your profile picture, I suggest you seriously consider the wisdom ofthe decision. Remember, today it is only products and events you have explicitlyliked or subscribed to, but Facebook has nmuch deeper claims to your picturesand are only a policy change away from using profile or other pictures topromote anything they like.

Randy Abrams

Independent Security Analyst

Facebook – Timeline or Time Bomb?

2011-12-19T20:47:00.000-08:00

Facebook is changing the way you see the site. Instead ofthe coherent flow of updates and information you currently enjoy, Facebook iscopying the older MySpace style layout, to give all of the pages a scrapbooktype appearance, and ripping off Timeline.com by prominently naming it “Timeline”.

The change is significantly more far-reaching than creatingchaos out of order. You better start reading and understanding the privacyimplications. You might want to take a look at what PC World calls “6 must-do privacy tweaks”.

If you haven’t seen the new look, then you might want toread about everything you are likely to hate about the new look at http://www.theatlanticwire.com/technology/2011/12/everything-youll-hate-about-new-facebook-timeline/46237/.

Most users have probably not yet been converted over to thenew look, but already there is a growing backlash. Pages like Undo Timeline https://www.facebook.com/pages/Undo-Timeline/322551701106897are rapidly gaining in popularity and user complaints are rampant. Facebook isnot at all likely to listen to user complaints however. The reason behindtimeline is not to enhance the user experience, it is to sell more advertising.One of the metrics Facebook uses to sell ads is how much time users spend onthe site. The new look forces users to spend/waste more time setting up theirpage and viewing other pages. By design, most of the page is wasted at the top witha graphic, called a ‘cover’, that you probably don’t want to see on every visitand only serves to keep you on the page longer.

So, how do you protest the change? Liking pages, such asUndo Timeline is a start. When you set up “Timeline” Facebook they ask that younot use a cover that is the same as someone else’s. I recommend that allprotesters choose the same cover. Feel free to use the one I will be using…

This alone is not likely to accomplish much, other than toamuse others who dislike the change, but there is something you can do thatwill be effective if millions of protesters join in. If you make timelinesunattractive to advertisers then Facebook will either listen or disablefeedback. Here is how you effectively protest.

When you visit a page go straight to the ads and point tothe upper right corner of the ad. This will make a little X appear that you canclick on and choose to hide the ad. Next you will be asked why you are hidingthe ad. I suggest you choose “other” and type in “Protest Timeline”. Here aresome pictures to help you. Apologies to Lutron Electronics, nothing againstthem, but their ad was handy.

There is likely no more effective protest against Facebookthan to kick them in the advertising dollar.

Some people are going to like or even love the change andthat is fine for them, but if Facebook cared as much about a quality product asthey do about advertising, the change would be an option. The fact is thatFacebook knows most people will dislike the change and so they force it.

So, where does the time bomb come in? Mark Zuckerberg isalleged to have stolen the idea and code for Facebook from a couple of otherHarvard students. The claim was compelling enough that Facebook settled alawsuit for a significant sum of money and stock. http://en.wikipedia.org/wiki/ConnectU.Seemingly, even a young dog isn’t learning new tricks and a website called Timeline.comhas filed suit against Facebook for trademark infringement. If you know Facebook’shistory, then you know that Facebook is engaging in far more egregious activitythan others have that Facebook accused of Trademark infringement. Facebook,following the ethical leadership and ideals of its founder has filed a countersuitthat really should thrown out as being frivolous. If justice prevails thentimeline will blow up in Facebook’s face. I recommend you read the followarticle to understand how two faced Facebook can really be http://paidcontent.org/article/419-facebook-countersues-timelines.com/.

Regardless of whether you like the new look or not, rememberto routinely check your privacy settings on Facebook. I recommend you set up adummy account that you do not friend so that you can see how the rest of theworld sees your profile.

Randy Abrams

Independent Security Analyst

Facebook is Tracking You (Even If You Don’t Use Facebook)

2011-12-16T14:22:00.000-08:00

Occasionally when I rant about Facebook privacy a misguidedfriend will suggest that I simply delete my account if I don’t like it. Asidefrom the fact that deleting my account in no way makes Facebook privacy abusesgo away, it also does not stop Facebook from stalking me or anyone who visitswebsites using certain Facebook technologies. You do not need a Facebookaccount for Facebook to be able stalk you.

Facebook uses a technology called a “Social Plugin” to trackinternet users and aggregate information about them, even if you don’t have aFacebook account. Facebook claims that it is not collecting personallyidentifiable information, but Facebook does not identify what information theyare collecting, exactly how it is used, or what they define as “personally identifiableinformation”.

Here is how it works. The image below is from a web sitethat uses a Facebook social plug in. Iam logged into my Facebook account and in a different browser tab I look up “how to use an anonymizer” onehow.com.

Down by the comments section I see the following:

Did Facebook just tell ehow.com what my Facebook identityis? If you believe Facebook, the answer is no. According to Facebook (https://www.facebook.com/help/?page=209089222464503)“Whilesocial plugins appear on other websites, the content populating them comesdirectly from Facebook — so they're just an extension of your Facebookexperience. Plugins were designed so that the website you are visiting receivesnone of this information.”

Ehow simply gave Facebook a little space on their web site andtold Facebook that you dropped in to visit them. Yes, in a contradictoryprivacy policy, ehow.com claims they don’t provide third parties withpersonally identifiable information while admitting to providing your IPaddress, which in many cases is personally identifiable information.

Now, let’s look at a visit to the same ehow.com web pagewhen I am not logged into Facebook, and have deleted my browsing history andcookies (and HTML 5 information too).

Is this “anonymous”? Probably not. You see, Facebook alsoexplains on the same help page I referenced above:

“If you’re logged out or don’t have a Facebook account and visit a websitewith the Like button or another social plugin, your browser sends us a morelimited set of information. For example, because you’re not logged in toFacebook, we don’t receive your user ID. We do receive the web page you'revisiting, the date and time, and other browser-related information.”

Your IP address is “browser-related information” and ispersonally identifiable enough to get you arrested if the police think you havebeen doing something illegal with your computer.

So, let’s say you do not have a Facebook account and land ona web page with a Facebook social plugin. What happens? According to Facebook:

“…we may use anonymous or aggregate data to improve adsgenerally”

In other words, Facebook is using your web browsing foradvertising related purposes. Facebook is making money off of your browsing byspying on you whether or not you have a Facebook account.

Can you opt out? This is where Facebook refuses to give adirect answer to a direct question.

Privacy

How do I opt out of viewing social plugins?

No personally identifiable information is shared about you with thewebsite when you see a social plugin on an external website.

The Like action is similar topublic comments or reviews you might write on a website and are shared back toyour Facebook profile (timeline). You can choose who can see the things youlike in your privacy settings. If you would not like to see what your friendsrecommend or have shared on a website, simply log out of Facebook.

The Send action lets youselect specific people and send them a link and short note as a privateFacebook message, Facebook Group post, or email.

You see, Facebook refuses to answer the direct question theypublish on their website.

Facebook also lies…

“If I visit a site that uses social plugins but don't interact withthem, has any information been shared about me?”

No. When you simply view a social plugin on another site, it's like awindow into Facebook. It may appear personalized, but none of your information- your name or profile (timeline) information, what you like, who your friendsare, what they have liked, what they recommend - is shared. Similarly, nopersonal information about your actions is provided to advertisers.

The correct answer is yes, the website just told Facebookthat you visited them.

Now Facebook claims that they anonymize the data, but thendelete doesn’t mean the same thing to Facebook as it does to reasonable people.Consider the “deleted data an Austrian man received when he requested theinformation that Facebook has about him. http://www.mail.com/int/scitech/news/793886-austrian-student-takes-facebook-privacy.html.

Believe it or not, my concerns over Facebook’s privacypolicies are not the paranoid delusions of a lunatic. There are a lot of uslunatics :)

Facebook’s privacy policies are not only bad, but thecompany is so distrusted that they must submit to audits by the FTC every twoyears for the next 20 years. In Europe where some privacy laws aresignificantly closer to actual privacy laws than in the USA, multiple countriesare taking action or considering action against Facebook for illegal practices.Here are just a couple…

Reported at http://www.thejournal.ie/irish-data-chiefs-set-to-test-if-facebook-%E2%80%98like%E2%80%99-button-is-illegal-209273-Aug2011/

“The incoming complaint focuses on how the ‘Like’ button allows Facebookto track the online activity of any web user – even those who are not among thesocial networking site’s 750 million members worldwide.”

and “Thilo Weichert, who works for the dataprotection centre of the northern German state of Schleswig-Holstein, said thesocial network’s application allowing internet users to express theirappreciation of something online, illegally cobbled together a profile of theirweb habits.” at http://info-wars.org/2011/08/20/facebook-%E2%80%98like%E2%80%99-button-declared-illegal/

It really isn’t just Facebook, but the sites that grantFacebook the space on their web page to enable Internet spying by Facebook.

Currently the only ways I know of to thwart Facebook andother unscrupulous web entities is to use and anonymizer and ad blockingbrowser plugins. I’ll try to get around to writing more about those in a futureblog.

I will definitely write about the “Do Not Track Online Actof 2011” which is being strongly opposed by anti-privacy organizations like theDirect Marketing Association (DMA).

Randy Abrams

Independent Security Analyst

Artificial Shine for Chrome - Google Buys “Test” Report

2011-12-13T09:18:00.000-08:00

I know some of you haven’t seen the “behind-the-scenes”shenanigans that can happen when a company pays another company to test theirproduct. There are definitely some cases where this works and the results arenot biased, but this post shows some tell-tale signs of a seriously biasedreport that undermines the credibility of the buyer (Google in this case) andthe tester (Accuvant Labs in this case). There are more egregious examples ofpoorly executed paid grades, but like the test for Google’s Chrome browser, theexample I have in mind involved Internet Explorer. Browser testing seems tobring out the worst in test bodies.

Back in 2009 Steve Regan at The Tech Herald asked “Can youtrust the NSS Labs report touting the benefits of IE8?” http://www.thetechherald.com/articles/Can-you-trust-the-NSS-Labs-report-touting-the-benefits-of-IE8.NSS Labs made the cardinal error of failing to disclose that Microsoft had paidfor the test. In the report I am writing about, Accuvant didn’t make thatmistake. Kudos for admitting up front that Google is their client.

Evidently Accuvant got a nice chunk of money to try to find any possible testthat Google’s Chrome browser might come out first in. OK, quite possibly Googledid the research and asked Accuvant to independently test it and report thatthe criteria meant Chrome was the best.

Accuvant did the requested paid testing and issued a textbook “I got a marketing degree and I follow the template” type of pressrelease. http://www.accuvant.com/news/2011/12/09/accuvant-releases-web-browser-security-research-findings

The first part of the first sentence in the press release isa dead giveaway that this is marketing-driven and not research-driven. “Accuvant,the only research-driven information security partner delivering alignment,clarity and confidence to enterprise and government clients,…” Theonly? Yeah, right. Is there any research-driven evidence to substantiate thatobviously marketing-driven claim? A wordto the wise... When a testing organization has to fabricate their stature togrant validity to their skills, be very, very, skeptical. So we start the press release with a grandioseclaim that is best used to enhance the growth of plants. You don’t have to getpast the first paragraph to run into more conclusions that are not substantiatedby the testing. The last sentence in the first paragraph is “Conducted by therenowned Accuvant LABS research team, the research finds that Google Chrome iscurrently the browser that is most secured against attacks.” Whether or notAccuvant Labs is renowned is a subjective argument, but a review of the testingshows that the conclusion that Chrome is most secured against attacks is notvalidated by the study. The study measures resilience to a narrow range ofattacks.

A bright spot for Accuvant customers is that while Accuvantmay be marketing-driven, rather than research –driven, they are very customerfocused!

The press release touts the report as “Browser Security Comparison: AQuantitative Approach” but by the time you finish reading the102 page report one of the glaring omissions is “How Much”? Yes, if you aretelling me that one browser is safer than another in a “quantitative” report,then I do expect to be told how much safer. In this case the word quantitativeis reflective of the marketing nature of the report.

While the press release calls the testing comprehensive, theactual report goes to great lengths to explain why Accuvant (and presumablyothers) are unable to test important metrics. Once the metrics are described asunable to be accurately measured then the report tries to dismiss them asunimportant. The test focuses on a very narrow range of testing and thenAccuvant misrepresents the testing as comprehensive. This is NOT acomprehensive test.

The press release claims “We compared web browsers from alayered perspective,” yet the actual report explains why layers of protectionwere not included in testing. Notably… “Microsoft’s application reputationcomponent and Chrome’s malicious executable detection were not included in thecomparison.”

The report is full of conclusions and unsupported assertionsthat undermine its credibility and demonstrate a project undertaken with thegoal of supporting a foregone conclusion.

Here is what you can conclude from the testing. On oneoperating system (Windows 7 32-bit) one version of Google Chrome performed betterin the limited scope of testing.

The report completely fails to demonstrate that the better performancehas actually resulted in better protection as substantiated by the results ofreal world attacks. The test is not valid for 64-bit Windows, and the test doesnot show that any of the browsers offer any better protection than one anotherin a layered defense, such as when one uses SandBoxIE (www.sandboxie.com).

The two most critical elements in browser security are theuser and making sure you are using a current browser.

It would be nice to know if one browser is more secure thananother, how much more secure, and how consistently, but the Accuvant test wasnot designed to answer these questions, it was designed to deliver the productthat Google paid for. Yeah, Chrome does look pretty shiny under artificiallight!

Randy Abrams

Independent Security Analyst

Two Rules You Damned Well Better Know

2011-12-12T12:12:00.000-08:00

Phishing is a wide spread Internet plague that is often usedto fraudulently obtain usernames and passwords, bank account numbers and PINs, andother information used to steal money and information. Phishing generallyrefers specifically to email based attacks, but like most security terminologythere are some that use the term more broadly.

The results of a successful phishing attack can result in acriminal emptying your back account, stealing your Facebook Account, raidingyour PayPal account, or even hacking into your company’s network.

Most anti-phishing education to date has been focused aroundtrying to teach people what a phishing attack looks like. I am all foreducation and if someone can teach you to be better at spotting a phishingattack it is a good thing, but the truth is these attacks can be sosophisticated that even security experts can be fooled or have a very hard timedetermining if a specific email is legitimate or not.

To try to help people defend against phishing attacks I usea method that I believe is far more effective. You see, the problem is not thatyou received and phishing email and did not realized you were under attack, theattack is only a problem if you engage in the behaviors that allow the attackto succeed. If you follow my two simple rules meticulously you will dramaticallyreduce the odds of a successful phishing attack against and it doesn’t matterif you know it is a phishing attack.

Rule #1

There are only two types of people who ask you for yourpassword… Thieves and idiots. You obviously do not want to give your passwordto a thief, and if you give it to an idiot, they’ll probably get tricked intogiving it to a thief.

So when you get an email that says Hotmail, or PayPal, yourbank, or someone else you do business with needs your password, it is a thief,not your bank, not PayPal, not EBay, not, Hotmail or Gmail, it is a thief. Thereisn’t a problem with your account. They are not updating their securitysystems, and it didn’t come from where you thought it did.

A common attack is for a person to call an employee andclaim to be from helpdesk. The conversation progresses and they claim to needyour password, or they need you to change your password to one they provideyou. Changing your password to something someone else provides you is the samething as telling someone else your password.

OK, there are exceptions to every rule, but if there is anexception to this rule, be very, very alert. For example, there may be a raresituation where IT at your workplace needs your password to help you resolve anissue. First off, in this case you initiated contact with IT, not the other wayaround. The second thing to know is that even if it is a rare, but legitimateneed for your password, as soon as the problem is resolved you change yourpassword. Not 30 minutes after the problem is resolved, not a day after, butimmediately after the problem is resolved you change your password. CompetentIT professionals do not want to know your password any longer than may rarelybe required.

If it is your Internet Service Provider (ISP) asking foryour password, you are dealing with an idiot. It may not actually be the technicianon the other end of the phone, it may be a higher up who was ignorant enough tohave a technician ask you for your password. Don’t give it to them, it probablyis an attack.

To make it easy, pretend there can be absolutely noexceptions and whenever you see a request for your password in email, instantmessaging/chat, or hear a request for your password on the phone, remember thatyou are dealing with a thief or an idiot and keep your password to yourself!

Rule #2

If you click on a link and it takes you to a login page, don’tdo it. This is the most common type of phishing attack and is equally successfulagainst high level executives as it is against a grandparent using a computerfor the first time. The real travesty is that millions of times each daysocially irresponsible sites like Facebook and LinkedIn teach people to becomevictims of phishing attacks.

Take a look at these two screen shots of emails I haveactually received, and tell me if they are legitimate or phishing attacks?

You really can’t tell from looking and it really doesn’tmatter because I am not clicking on the links in the emails. If these arelegitimate then if I simply log into Facebook and LinkedIn, the notificationswill be there. If these were well crafted phishing attacks, then when I clickedon them I would be presented with a very, very real looking login screen and acriminal would have my account credentials after I logged into the fake site.

It doesn’t matter if it is in email, chat, a Facebookcomment or most anywhere else. If you click on a link that asks you to login,close your browser, open it back up, type in www.facebook.comor www.linkedin.com or whatever the realsite is and log in there. Anything of importance will be there for you to find.The fake LinkedIn request has been quite successful against executives, wherepassword requests to fix a problem with your Hotmail, Yahoo, or Gmail accountwork well with the general public.

You may think that there is nothing of value in yourFacebook or email account, but you would be wrong. These accounts can be usedto send spam and to trick your friends into believing a criminal is you so thatyour friends can be the victims of cybercrime.

Yeah, there’s more you need to know to be safe online, butfollow these two simple rules religiously and you have drastically improvedyour security profile!

Randy Abrams

Independent Security Analyst and Educator for the Masses J

Facebook Phishing Works Better on an Android (Than a PC)

2011-12-09T10:35:00.001-08:00

Your Android device may put you at significantly more riskto a phishing attack than your computer does. Yesterday I blogged about aphishing attack that appeared as a comment in my nephew’s Facebook statusupdate. There was an interesting difference between clicking on the link in thecomment on my android phone and clicking on the link on my computer.

I have disable apps on Facebook. I do this because apps areone of the ways in which I believe Facebook has historically shared myinformation without my prior knowledge or approval. I also don’t believe appson Facebook are well enough vetted to warrant trust in many cases, but mostly Idisable apps because if you don’t disable apps then creepy advertisers stalkyou mercilessly.

The phishing attack I reported in the blog started atapps.facebook.com/xxxxxx and on my computer when I clicked the link Facebookrecognized that I don’t use apps and would not take me to the page unless Ienabled apps, which I did not do.

No compare the PC experience to the Android experience. Iclicked on the link in the Android Facebook app and Facebook took me to their appspage which in turn took me to a Google page which in turn to me to the Russianpage that was hosting the phishing attack. Naturally this all occurred soquickly it simply looked like I went from clicking on a comment to a Facebooklogin page.

There is another even more significant difference. On mycomputer when I went to access the phishing page my browser warned me that itwas an attack page. On my Android phone there were no warnings. I did sometesting with samples from www.phishtank.comand it appears that the stock Android browser has no anti-phishing technologybuilt in at all.

The tiny web pages that are often displayed differently on asmall portable computing device, such as a cell phone, already take away somepotential visual clues, but the lack of anti-phishing technology on theplatform make users of Android (and possibly Windows, Apple, and Nokia) devicesput users at a higher degree of risk, unless… you come back for my next blogabout the two simple rules of avoiding phishing attacks. The two rules evenhelp Windows, Linux, and Mac users. Yes, Mac users are at as much risk tophishing attacks as Windows users are, even if Apple pretends that Macs areinvincible. Phishing for login credentials isn’t an operating system dependentattack, it’s a user attack.

Randy Abrams

Independent Security Analyst

Lies, Damned Lies, and Facebook Comments

2011-12-08T15:05:00.001-08:00

Lies, Damned Lies, and Facebook Comments

In checking my Facebook newsfeed, I spotted a ratherinsensitive attempt at humor in one of my nephew’s status updates. This isn’tsurprising, it runs in the family, but what was surprising was some else hadcommented on his status saying “I can not believe you are in this with her. Wow.http://apps.facebook.com/xxxxxxxxxxxx”.There are numbers where the x’s are, but I don’t want people following thelink. Yes, it points to an unsafe Facebook page that links to an unsafe Googlepage that redirects to a phishing page in Russia. The phishing page is down fornow, but could reappear.

For my Nephew’s fiends that clicked on the link they areredirected to a page that looks like this.

The icon in the address bar looks like Facebook. The loginscreen looks like Facebook, but this is not Facebook at all. If any of my nephew’sfriends logged in here they gave the bad guys their username and password.

Never, ever, ever log into anything from a link you clickedon in a Facebook comment. In fact, you should never log into Facebook unlessyou typed in www.facebook.com. Yes, thatmeans you don’t click on a comment in an email and then log into your account,you log into your account by manually typing in the name of the web site.

The reality is that people’s Facebook accounts getcompromised all the time. Just because it shows up as a friend saying it, itdoesn’t mean the friend actually did say it. Just because a link says somethingit doesn’t make it so. For example, where would you expect this link to takeyou? http://www.facebook.com/. Go aheadand click it, just don’t log in!

Remember, the bad guys know that Facebook users aregenerally really easy to trick, and they will stop at nothing to get ahold of youraccount. Your account is actually valuable to criminals, so they want it. Ifyou use your Facebook password on other websites as well, if your Facebookaccount is compromised your other account(s) probably will be compromised aswell. If your email account is compromised it may cost your friends a lot ofmoney too. It is very common for an attacker to steal an email account and thenemail “friends” claiming to be in dire circumstances and in need of somemonetary help. It happens all the time.

So, remember, there are lies, damned lies, and Facebookcomments. Keep alert, stay safe, never log into Facebook or other sites from alink you clicked on, whether it is in a friend’s comment or a “Facebook” emailyou received.

Randy Abrams

Independent Security Analyst

Parents Defeat the Child Online Privacy Protection Act (COPPA)

2011-12-07T14:06:00.001-08:00

COPPA is the whipping boy of Facebook, Google, and other websites that do not allow children under the age of 13 to participate. COPPAinstitutes legal obligations to maintain basic levels of privacy for childrenunder 13. Oncea kid turns 14 all bets are off and there is no significant legal protectionagainst the exploitation of personal information in the United States. For clearing houses of personal information, such as Google andFacebook, the logic goes that if the law prevents them from exploiting children’sprivate information it’s better to deny them access and blame the governmentfor requiring a modicum of decency.

As I was investigating the recent FTC settlement withFacebook, I stumbled across a goldmine of information in a place I wasn’texpecting to find one. Who would have known that a law firm that specializes inadvertising law would be such a great resource? So to start, a hat tip to Manatt,Phelps & Phillips, LLP (http://www.manatt.com/default.aspx),in particular their newsletter areas where I came across an article titled “Parents Help Kids Violate COPPA” at http://www.manatt.com/newsletter-areas.aspx?id=15442#Article7.(You have to scroll down a bit to find it.)

The article distills Information from a study titled “Whyparents help their children lie to Facebook about age: Unintended consequencesof the ‘Children’s Online Privacy Protection Act’” and indicates that themajority of underage children who join Facebook are doing so with thedeliberate assistance of their parents. In other words, their parents arehelping their kids to lie about their age. Of 1007 parents interviewed, exactly2 knew that Facebook’s age restrictions had anything to do with privacy. Forthe Big Bang Theory crowd, that’s about 0.19860973187686196623634558093347% ofparents who know that privacy is the reason for Facebook and Google’s agerestrictions

The report is a very interesting read and can be found at http://www.uic.edu/htbin/cgiwrap/bin/ojs/index.php/fm/article/view/3850/3075.

While COPPA was designed to curb privacy abuses, rather thanstep up to the plate and offer ethical services, the reports states “…FederalTrade Commission has conceded that, in response to COPPA, online industrieshave generally neither innovated nor emphasized mechanisms for obtainingverifiable parental consent”

The crux of the report is summarized in the Manatt articleas:

Instead, based on theresearch data, the report “propose[s] that policy-makers shift away fromprivacy regulation models that are based on age or other demographic categoriesand, instead, develop universal privacy protections for online users.”

This is really the insane notion that organizations, such asFacebook and Google should not only afford better privacy practices to childrenbecause they are legally required to, but to all people because it is the rightthing to do.

Protecting the privacy of children is something Facebookfounder Mark Zuckerberg has vowed to fight. The report states “Mozelle Thompson— a member of Facebook’s advisory board who is also a former FTC commissioner —asserted that “Facebook removes 20,000 people a day, people who are underage”and then continues with “And while Facebook takes steps to remove underageusers, Facebook’s CEO Mark Zuckerberg stated at a talk on education thatFacebook only imposes the under–13 prohibition because of COPPA’s restrictions(Lev–Ram, 2011). He argued that younger children should be allowed to get onFacebook because doing so is an important part of the educational process. Withregard to COPPA, Zuckerberg stated, “That will be a fight we take on at somepoint”

The research is timely and relevant because, as the Manatt newsletterpoints out:

“Why it matters: The report comes as the Federal Trade Commission considers updatesto COPPA and federal legislators debate the enactment of national privacylegislation, including the "Do Not TrackKids Act of 2011,” which would expand the protections of COPPA.”

Randy Abrams

Independent Security Analyst

You Will Be Known By the Company You Keep

2011-12-06T10:55:00.001-08:00

There is an old saying that you are known by the company youkeep. In the world of Android this is a very interesting and telling story ofthe lack of respect for privacy by the major players.

In March of 2011 Twitter and the FTC reached a settlementbrought on by Twitters gross negligence in the protection of privateinformation they were responsible for.

Also in March of 2011 The FTC and Google reached asettlement brought on by Google’s deceptive practices and violations of privacypolicies in the launch of Buzz. In a nutshell, Google abused the access toGmail user’s contact information to expose confidential information without consentor approval of the users.

In November 2011 Facebook reached a settlement agreementwith the FTC because Facebook abused its access to consumer data.

In all of these cases what is clear is that these arecompanies who through incompetence, greed, or malice have demonstrated thatthey cannot be trusted to keep their word and deal with consumers data with honesty,respect and integrity. Personal information entrusted to these companies cannotbe expected to remain as confidential as promised.

The big buzz in the Android space is Carrier IQ. Carrier IAis a company that makes a rootkit that secretly records a ton of private information.It really isn’t just Androids, many iPhones have the software and reportedly sodo Blackberrys.

So who is in the company of these privacy deficient companies?Why T-Mobile, of course. T-Mobile almost certainly is not the only carrier toshare their bed and perhaps your intimate thoughts with these strangebedfellows, but I have a T-Mobile phone, so I report from experience.

Facebook, Twitter, and Gmail came pre-installed on my HTCMyTouch 4G Slide and regardless of the track record of these companies,T-Mobile refuses to let users remove these applications. In all fairness thereare also other applications that are useless to many users, but look a lot likespyware and T-Mobile will not allow the removal of the applications. T-Mobilealso never obtained informed consent from consumers to share data with these companiesthrough their ad supported software. In other words, T-Mobile installs softwarethat may be siphoning off private information without informing the consumer orobtaining consent.

Ironically, Carrier IQ is one of the few programs that mightbe actually doing something required to improve the functionality of thedevices it is installed on and that is the focus of class action lawsuits andcongressional investigation. It really is a travesty. The class action lawsuitsand congressional investigations need to be focused on carriers forcingconsumers to disclose confidential information without notification, consent,or the ability to remove invasive software that is not required forfunctionality.

In the coming days I will report on some other applicationsthat appear to be preinstalled spyware. One such application is a demo ofBejeweled 2. I am to have a conversation with an executive from ElectronicArts today to discuss my concerns that Bejeweled 2, the demo version that ispreinstalled on my phone, may be spyware. I look forward to a respectful andinformative conversation and will report back the results. It may take a whileas the executive may need to do some research into why some things are designedthe way they are and what, if any, corrective actions might be taken.

The bottom line is that Carrier IQ has made people look thewrong way so they you don’t see the potentially massive data leaks form thesoftware on your phone that is in plain sight.

Yes T-Mobile, those known to be some of most egregious violatorsof privacy and respect are the company you keep and appear to emulate.

It really is time for the FTC and congress to take aninformed look at mobile providers and cell phone manufacturers. Carrier IQ isthe tip of the iceberg.

Randy Abrams

Independent Security Analyst
Updated: Electronic Arts, rather than Entertainment Arts. Thanks for the heads up Jon Poon!

Mark Zuckerberg, I’ve Read Terry Pratchett and You are no Terry Pratchett

2011-12-05T17:51:00.000-08:00

Terry Pratchett is one of the greatest satirical fiction writers to ever have lived. Mark Zuckerberg is really good at building a business, but his recent attempt at satirical fiction would be laudable were it not missing humor.

Facebook has entered into a settlement agreement with the Federal Trade Commission over allegations of privacy violations. The allegations were severe enough that facing a losing battle Facebook agreed to be audited every two years for the next 20 years. That’s a long time to submit to auditing. Zuckerberg went on to write a highly satirical blog that is so subtle some may think his marketing department got a hold of some LSD and wrote a press release.

You can read the satire of Zuck at https://blog.facebook.com/blog.php?post=10150378701937131.

Zuck says “I founded Facebook on the idea that people want to share and connect with people in their lives, but to do this everyone needs complete control over who they share with at all times. This idea has been the core of Facebook since day one.”

In case Sheldon (Big Bang theory) is reading this, yeah, that’s sarcasm. Here’s the story of the early days.

http://articles.businessinsider.com/2010-05-13/tech/30034517_1_instant-personalization-privacy-flap-privacy-policy

Zuckerberg offers to give someone private email, pictures, and other confidential information that belong to Facebook users and explains that the people who entrusted him with that information were “dumb fucks”. See the sarcasm where Zuck explains the idea upon which Facebook was founded? Rewriting history or an attempt at satire?

Zuck goes on to say “Overall, I think we have a good history of providing transparency and control over who can see your information.”

You might think that by transparency Zuck means you can see what Facebook is doing, but in fact, and this is probably what he considers comic genius, he means that everybody can see everything regardless of what you want. You see, Zuck doesn’t actually specify WHO has control of who can see your information.

As the “blog” progresses, Zuck tries the use of Orwellian double speak. Referring to settlements with Twitter and Google for alleged wrongdoings as “establishing agreements” Zuck merrily claims that Facebook has entered into such an agreement. Dude, you agreed to be audited for lousy privacy practices! (Yes, Sheldon, he was being sarcastic again).

Mastery of the old knife in the back gag is demonstrated in the first sentence of the closing paragraph…

“Finally, I also want to reaffirm the commitment I made when I first launched Facebook.”

What commitment was that, Mark? Giving out private information and calling us dumb fucks?

One of the steps Mark claims that Facebook has taken to improve privacy is improved mobile privacy controls. Well, why is it that I can’t uninstall Facebook for HTC Sense from my Android phone? Would it have anything to do with a marketing agreement where Facebook gives Money to T-Mobile in exchange for making sure that their customers can’t remove Facebook from their phones?

I believe Mark and I am certain that Facebook will tell T-Mobile (and other carriers) to make tools available that will completely remove Facebook from Android devices if the software is unwanted.

Yes Sheldon, that was sarcasm too.

Randy Abrams

Independent Security Analyst

Android – The Spyware Platform

2011-12-03T11:12:00.000-08:00

Much has been made recently of the Carrier IQ rootkit software installed on many phones. If you aren't familiar with Carrier IQ, google it.

While there are still questions as to whether or not Carrier IQ’s software broke any laws or was ever used for anything other than helping carriers to improve services, the real stench is the spyware that is factory pre-installed by carriers such as T-Mobile. You, as a user are not allowed to uninstall the spyware you don't want, manufacturers, such as HTC act as the enforcer for the cellular providers by nullifying the warranty of your phone if you take the only action possible to eradicate unwanted spyware from your cell phone… rooting the device.

I maintain that any software installed on your cell phone that can access and utilize personal information without your informed consent, is not required for the functionality of the device, and cannot be removed is spyware. If you choose to install a program that is supported by adware and it has access to your contacts, the manifest reveals that this is the case. If you don’t like it, you can decide to remove it. If you don’t agree to grant such access to the program, you don’t install it.

Now take a look at the factory pre-installed applications on your Android device that you don’t use, the permissions they have been granted that you never approved of, and see if you are able to remove them. In settings>applications>manage applications, choose all applications and then when you select an application there will be a functional uninstall button if you can uninstall it. If you scroll down you will see the permissions the application has been granted. Without some sleuthing, you really don’t know if the program is using those permissions all of the time or only when you run the app.

I will discuss specific spyware applications that T-Mobile has forced upon users in future blog posts.

Welcome to Security through Absurdity!

2011-12-02T16:31:00.000-08:00

I will use this blog to comment on security and privacy issues, but now and then any topic will be fair game!