6 ms·
Lets say I ran a well-known business that sold a some sort of physical product. It could be a toy, a common household tool or appliance, or anything else that
by pdkl95 11y ago
Lets say I ran a well-known business that sold a some sort of physical product.
It could be a toy, a common household tool or appliance, or anything else that is small and inexpensive. It more-or-less works as intended, but it also included a small robot. The packaging and marketing would be designed so you weren't supposed to notice the robot, but the packaging included the necessary fine print and an explanation that this robot was just there to make sure you got the best experience possible for anybody that spotted this "extra feature".
Unrelated to whatever it was that you bought, at night the robot would install a device on your phone that re-routed all your phone calls through my office (a MITM attack). The phone still works ok, except now calls to your favorite pizza deliver restaurant seem seem to be re-routed to the competitor across town. Some time later a neighbor complains that he can sometimes when he checks his voicemail, he gets your phone conversations instead.
After finishing with the phone, the robot does the same thing to your cable TV.
Some days, the robot would go through your (physical) mail and place stickers with new advertisements into your magazines. Occasionally one of those stickers would end up on your electric bill, obscuring important information. The power company has a similar logo to one of the sticker-ads, so the robot probably confused the two logos. Even if the robot didn't have any stickers to place, it would still open your mail and leave it (opened) on the ground near your mailbox for anybody to see.
If I rand a business that did this - possibly as my main (or only) product - how long would I be able to run this scam before someone threw me jail?
--
Intentionally breaking TLS with a MITM attack goes way beyond the usual scam/trojan. This isn't even the usual negligence that we see in the "security" of a lot of products. Creating a certificate that lets you MITM any domain is very obviously a willful act.
- Fundlab 11y agoWhy hasnt companies like Download.com and CNET been dragged to court yet beats me. People have had to pay hard cash just to have their systems purged many have lost priced documents and information while attempting resets because of this. Is this some sort of favorable treat?
- anexprogrammer 11y agoOr at a more simplistic level, why haven't Google, Firefox et al simply blocked download.com as serving malware? Even something that simple happening far more frequently, might mean sites carrying ads gained some ethics. Maybe some of the ad networks would then be held responsible for the crap they regularly carry. ...and sites whine at the unfairness of the growing number of adblocking users. Right.
- jneal 11y agoThis is something I have been curious about as well. It seems like Google at the very least should be blacklisting download.com or at least showing the message they show for "bad" sites: "Warning: Visiting this site may harm your computer!"
- theandrewbailey 11y agoThen start reporting it: https://www.google.com/safebrowsing/report_badware/ https://www.google.com/safebrowsing/report_badware/
- JustSomeNobody 11y agoYou really want Google to be the custodian of all things bad? Besides, does Download.com, the site, actually give you malware? No. So why do you think Google should blacklist it?
- ntakasaki 11y agoBarely anyone cares about online privacy. MS found that out with the failed Scroogled campaign which they scrapped after it tanked. People value free stuff more than privacy. There are some interesting court cases going on though, with the analogs of your scenario but with student data. https://www.washingtonpost.com/news/grade-point/wp/2016/02/01/uc-berkeley-students-sue-google-alleging-their-emails-were-illegally-scanned/ https://www.washingtonpost.com/news/grade-point/wp/2016/02/0... http://www.edweek.org/ew/articles/2014/03/13/26google.h33.html http://www.edweek.org/ew/articles/2014/03/13/26google.h33.ht... https://www.eff.org/press/releases/google-deceptively-tracks-students-internet-browsing-eff-says-complaint-federal-trade https://www.eff.org/press/releases/google-deceptively-tracks...
- wnevets 11y ago>MS found that out with the failed Scroogled campaign which they scrapped after it tanked. it tanked because it was a terrible campaign not because people don't care about online privacy. The fact that it was MS all of companies running it made it even more terrible.
- ntakasaki 11y agoDo you think that if Mozilla ran a similar campaign it would see more success? Somehow I don't think so.
- wnevets 11y agoConsidering google was paying mozilla to be the default search engine in firefox, most tech savvy folks would of seen it just as silly.
- rasz_pl 11y agoactually that campaign was a full success - it made MS realize no one cares about privacy, this led to Win10 spying on _everything_
- wnevets 11y ago
- jimrandomh 11y ago> If I ran a business that did this - possibly as my main (or only) product - how long would I be able to run this scam before someone threw me jail? If you put a reasonable amount of effort into legal defense, you could get away with it indefinitely. The US criminal justice system is non-functional in more ways than one.