Submit a link Features Reviews Podcasts Video Forums More ▾

Spyware increasingly a part of domestic violence

Australian Simon Gittany murdered his girlfriend, Lisa Harnum, after an abusive relationship that involved his surveillance of her electronic communications using off-the-shelf spyware marketed for purposes ranging from keeping your kids safe to spotting dishonest employees. As Rachel Olding writes in The Age, surveillance technology is increasingly a factor in domestic violence, offering abusive partners new, thoroughgoing ways of invading their spouses' privacy and controlling them.

The spyware industry relies upon computers -- laptops, mobile devices, and soon, cars and TVs and thermostats -- being insecure. In this, it has the same goals as the NSA and GCHQ, whose BULLRUN/EDGEHILL program sought to weaken the security of widely used operating systems, algorithms and programs. Every weakness created at taxpayer expense was a weakness that spyware vendors could exploit for their products.

Likewise, the entertainment industry wants devices that are capable of running code that users can't terminate or inspect, so that they can stop you from killing the programs that stop you from saving Netflix streams, running unapproved apps, or hooking unapproved devices to your cable box.

And Ratters, the creeps who hijack peoples' webcams in order to spy on them and blackmail them into sexual performances, also want computers that can run code that users can't stop. And so do identity thieves, who want to run keyloggers on your computer to get your banking passwords. And so do cops, who want new powers to insert malware into criminals' computers.

There are a lot of ways to slice the political spectrum -- left/right, authoritarian/anti-authoritarian, centralist/decentralist. But increasingly, the 21st century is being defined by the split between people who think your computer should do what you tell it, and people who think that you can't be trusted to control your own computer, and so they should be able to run code on it against your will, without your knowledge, and to your detriment.

Pick a side.

Spyware's role in domestic violence [Rachel Olding/The Age]

(via Geek Feminism)

Ethiopia: the first "off-the-shelf" surveillance state


"They Know Everything We Do", a new, exhaustive report from Human Rights Watch, details the way the young state of modern Ethiopia has become a kind of pilot program for the abuse of "off-the-shelf" surveillance, availing itself of commercial products from the US, the UK, France, Italy and China in order to establish an abusive surveillance regime that violates human rights and suppresses legitimate political opposition under the guise of a anti-terrorism law that's so broadly interpreted as to be meaningless.

The Electronic Frontier Foundation is representing a victim of Ethiopian state surveillance: Mr. Kidane had his computer hacked by Ethiopian spies while he was in the USA, and they planted spyware that gave them access to his Skype and Google traffic.

Read the rest

Samsung Galaxy back-door allows for over-the-air filesystem access


Developers from the Replicant project (a free Android offshoot) have documented a serious software back-door in Samsung's Android phones, which "provides remote access to the data stored on the device." They believe it is "likely" that the backdoor could provide "over-the-air remote control" to "access the phone's file system."

At issue is Samsung's proprietary IPC protocol, used in its modems. This protocol implements a set of commands called "RFS commands." The Replicant team says that it can't find "any particular legitimacy nor relevant use-case" for adding these commands, but adds that "it is possible that these were added for legitimate purposes, without the intent of doing harm by providing a back-door. Nevertheless, the result is the same and it allows the modem to access the phone's storage."

The Replicant site includes proof-of-concept sourcecode for a program that will access the file-system over the modem. Replicant has created a replacement for the relevant Samsung software that does not allow for back-door access.

Read the rest

How the NSA plans to automatically infect "millions" of computers with spyware




A new Snowden leak, detailed in a long, fascinating piece in The Intercept, explains the NSA's TURBINE initiative, intended to automate malicious software infections. These infections -- called "implants" in spy jargon -- have historically been carried out on a narrow, surgical scale, targeted at people of demonstrated value to spies, due to the expense and difficulty of arranging the attacks.

But TURBINE, which was carried out with other "Five Eyes" spy agencies as part of the NSA's $67.6M "Owning the Net" plan, is intended to automate the infection process, allowing for "millions" of infections at once.

The article mentions an internal NSA message-board posting called "I hunt sys admins," sheds some light on the surveillance practices at the NSA. In the post, an NSA operative explains that he targets systems administrators at companies, especially telecoms companies, as a "means to an end" -- that is, infiltrating the companies' networks. As Glenn Greenwald and Ryan Gallagher point out, this admission shows that malware attacks are not targeted solely or even particularly at people suspected of terrorism or other crimes -- rather, they are aimed at the people who maintain the infrastructure of critical networks and systems to allow the NSA to control those systems.

The malware that TURBINE implants can compromise systems in a variety of ways, including hijacking computer cameras and microphones, harvesting Web-browsing history and email traffic, logging passwords and other keystrokes, etc.

Read the rest

Detailed analysis of Syria's network censorship with logs from Blue Coat's surveillance boxes


In Censorship in the Wild: Analyzing Web Filtering in Syria [PDF], researchers from INRIA, NICTA and University College London parse through 600GB worth of leaked logfiles from seven Blue Coat SG-9000 proxies used by the Syrian government to censor and surveil its national Internet connections. They find that the Assad regime's censorship is more subtle and targeted than that of China and Iran, with heavy censorship of instant messaging, but lighter blocking of social media. They also report on Syrians' use of proxies, Tor, and Bittorrent to evade national censorship. It's the first comprehensive public look at the network censorship practiced in Syria.

Censorship in the Wild: Analyzing Web Filtering in Syria [PDF] (Thanks, Gary!)

American citizen and EFF sue Ethiopian government for installing British spyware on laptop

A US citizen had government-grade spyware placed on his laptop by the Ethiopian government, who proceeded to monitor his Skype calls, instant messages, and his whole family's Internet use. Finspy, the software the Ethiopian regime used was provided by Gamma Group, a British company that makes and sells spyware exclusively to governments. They attacked the US citizen's computer while he was in the USA.

The victim of the attack -- who is being called "Mr. Kidane" in order to protect his family in Ethiopia -- is suing the Ethiopian government in a US court, and is represented by the Electronic Frontier Foundation.

Read the rest

David Cameron: TV crime dramas prove we need mass warrantless electronic surveillance

UK Conservative Prime Minister David Cameron says that ISPs and phone companies should be required to store records of every click you make, every conversation you have, and every place you physically move through. He says that communications companies should be required to make it impossible to keep your communications from being eavesdropped in, with mandatory back-doors.

He says we need this law because "TV crime dramas illustrated the value of monitoring mobile data."

Remember the Snooper's Charter, the 2012 UK Conservative plan to require ISPs and phone companies to retain the records of all your calls and movements, and make them available to police and government without a warrant? Home Secretary Theresa May proposed an unlimited budget to pay ISPs to help spy on you, and called people who opposed this "conspiracy theorists" and said the only people who need freedom from total, continuous surveillance were "criminals, terrorists and paedophiles."

The Snooper's Charter was killed by a rebellion from Libdem MPs, who rejected the plan. Now it's back, just as the public are starting to have a debate about electronic spying thanks to NSA whistleblower Edward Snowden, who revealed the extent to which our online habits are already illegally surveilled by government spies. Let's hope that the Snowden revelations -- and the US government's admission that mass spying never caught a terrorist or foiled a terrorism attempt -- strangles this Cameron brainchild in its cradle.

Read the rest

Citizen Lab calls on Canada's telcos to publish transparency report

As American telcoms operators take up the practice of publishing transparency reports showing how many law-enforcement requests they receive, Canadian activists are wondering why Canada's telcoms sector hasn't followed suit. Citizen Lab, whose excellent work at the University of Toronto is documented in lab leader Ron Deibert's must-read book Black Code, has issued public letters addressed to the nation's phone companies and ISPs, formally requesting that they publish aggregate statistics on law-enforcement requests.

Read the rest

Ukraine government sends text to protesters: "Dear subscriber, you are registered as a participant in a mass disturbance"


Ukraine's dictatorship is revelling in its new, self-appointed dictatorial powers. The million-plus participants in the latest round of protests received a text-message from the government reading Dear subscriber, you are registered as a participant in a mass disturbance.

Read the rest

Scoring Obama's NSA reforms (spoiler: it's not good)


Earlier this week, EFF published a scorecard for rating Obama's NSA reforms. Now that the reforms have been announced, it's time to measure them up. They don't fare well, I'm afraid. Here's a roundup of commentary from privacy leaders around the world, expressing disappointment (if not surprise) at Obama's half-hearted reining in of the surveillance state.

Read the rest

When the FBI asks you to weaken your security so it can spy on your users


Nico Sell is the CEO of Wickr, a privacy-oriented mobile messaging system that's been deliberately designed so that the company can't spy on its users, even if they're ordered to do so. As we know from the Snowden leaks, spooks hate this kind of thing, and spend $250M/year sabotaging security so that they can spy on everyone, all the time.

After a recent presentation, she was approached by an FBI agent who asked her if she'd put a back-door into Wickr.

Read the rest

Jacob Appelbaum's must-watch 30C3 talk: why NSA spying affects you, no matter who you are

Sunday's Snowden leaks detailing the Tailored Access Operations group -- the NSA's exploit-farming, computer-attacking "plumbers" -- and the ANT's catalog of attacks on common computer equipment and software -- were accompanied by a lecture by Jacob Appelbaum at the 30th Chaos Communications Congress. I have seen Jake speak many times, but this talk is extraordinary, even by his standards, and should by watched by anyone who's said, "Well, they're probably not spying on me, personally;" or "What's the big deal about spies figuring out how to attack computers used by bad guys?" or "It's OK if spies discover back-doors and keep them secret, because no one else will ever find them."

Read the rest

Mandatory bug-bounties from major vendors

Brian Krebs proposes that software vendors should be forced to pay a bounty on all newly discovered vulnerabilities in their products at rates that exceed those paid by spy agencies and criminal gangs. He says that the bill for this would be substantially less than one percent of gross revenues, and that it would represent a massive overall savings when you factor in the cost to all the businesses and individuals who are harmed by security vulnerabilities. He doesn't explain what to do with popular, free/open software though. Cory 11

France's new surveillance law creates a police state

Jeremie from La Quadrature du Net writes, "France just turned into a surveillance state, adopting a sneaky surveillance framework in article 13 of its Defense Bill (Loi de programmation militaire). It drastically extends the exceptional regime of extra-judicial surveillance against terrorism, for broad motives, including for the purpose of 'preserving scientific and economic interests of France' which could enable total.surveillance of political activists, journalists, corporate watchdogs, etc."

Read the rest

Tech giants call for global surveillance law reform

Eight of the biggest technology companies in the world have jointly called for reforms to global surveillance laws, launching a site called Global Government Surveillance Reform, which sets out the following principles:

1. Limiting Governments’ Authority to Collect Users’ Information
2. Oversight and Accountability
3. Transparency About Government Demands
4. Respecting the Free Flow of Information
5. Avoiding Conflicts Among Governments

Read the rest