8 ms·

I found this article very shallow. It covers only spyware that are installed when a device is physically compromised. I was hoping it would cover spy/malware t

I found this article very shallow. It covers only spyware that are installed when a device is physically compromised. I was hoping it would cover spy/malware that install remotely through many more infection vectors like clicking text messages. I guess NSO/Pegasus malware has this capability. I barely use any apps and would gladly settle for a flip phone... I value privacy more than the ability to order food through my phone.

TheRealDunkirk 4y ago
> I value privacy more than the ability to order food through my phone. I know you didn't mean it like this, but I find it funny that it reads like we've abandoned the idea of calling a restaurant and just talking to a person to order takeaway.
- walterbell 4y ago
  > talking to a person to order takeaway Also supports small business by saving them double-digit app fees!
  - Jeremy1026 4y ago
    Not necessarily. The delivery apps set up proxy numbers to pass calls through, taking a lead fee. So you can't just search "sub shop near me" and call, as it might not be their actual phone number. Your best bet if you want to save the local place fees from the apps is walk in the first time, then call the number off the paper menu from then on.
    - xeromal 4y ago
      If they have a website, that's usually a good number too
    - walterbell 4y ago
      PiTM (Parasite in The Middle)
  - scarface74 4y ago
    I know a couple of small restaurant owners. Even ones that don’t go through UberEats or GrubHub that use SaaS restaurant software that also come with a white labeled restaurant specific app that accepts Apple Pay (standard credit card fees - not 30%) and other payment methods. They actually prefer it.
    - SoftTalker 4y ago
      Weird. The small places here (I'm thinking chinese take-out, for example) take cash only, order tickets are on paper, they don't deliver, and seem to be thriving. Have the Uber Eats and other tech middlemen started taking such a big slice of the profit that it's not worth it? Having worked in a restaurant, if someone took 30% of my gross it certainly would have been all of my profit and then some.
      - walterbell 4y ago
        NYC currently caps fees at 20%. Grubhub is lobbying for 30%. https://www.restaurantbusinessonline.com/technology/nyc-could-ease-its-20-delivery-fee-cap https://www.restaurantbusinessonline.com/technology/nyc-coul... > New York, like many cities, put a limit on third-party delivery fees during the pandemic to help restaurants that had come to depend heavily on the service. Last August, it became one of the few jurisdictions to make the emergency measure permanent ... Last year, it passed a first-of-its kind law that would force delivery providers to share more customer data with restaurants.
      - scarface74 4y ago
        I just said the opposite. Restaurants apps do not pay 30% even when going through the App Store. It’s a physical good and even if they do accept Apple Pay, they get charged standard credit card processing fees - $0.25 + 2-3% of the amount. I said they do not use GrubHub. They have their own system run as SaaS. The company they use takes care of the POS system, merchant accounts, and a white labeled app just for their store.
        walterbell 4y ago
- handedness 4y ago
  Many restaurant managers already have: I'm increasingly finding places won't allow phone orders, at least during peak hours.
  - SoftTalker 4y ago
    So call the places that do. This is called free market competition.
    - msm_ 4y ago
      But why? Ordering via app is more convenient, and the restaurants clearly don't mind fees.
- A4ET8a8uTh0 4y ago
  << just talking to a person to order takeaway. The sad thing is that even if you do that, the restaurants are now almost guaranteed to use your phone as unique identifier and use that data for, hopefully, their own purposes ( hopefully, because the lure of selling data might be too much ).
  - walterbell 4y ago
    It's good privacy practice to use cheap and disposable VOIP numbers for online/phone shopping, changed periodically.
moremetadata 4y ago
[dead]
sizzle 4y ago
You can read the whole paper shared by another HN user here: https://petsymposium.org/popets/2023/popets-2023-0013.php https://petsymposium.org/popets/2023/popets-2023-0013.php PDF Paper: https://petsymposium.org/popets/2023/popets-2023-0013.pdf https://petsymposium.org/popets/2023/popets-2023-0013.pdf
Liquix 4y ago
I was hoping it would raise the alarm regarding Google and Apple's overreaching, always-on data collection practices. 99% of people don't need to worry about an attacker gaining physical access to their unlocked device and installing an application. We as a society do need to worry about tech giants amassing enough data on us to gain an insurmountable AI-training-data advantage which makes them too useful as tools of the state to be regulated by said state. The irony of pointing out how to spot a "spyware" app disguised as a WiFi icon when the dozen Big G apps pictured alongside are collecting the same data...
- YeahNO 4y ago
  You would think the panic over TikTok spying would illuminate the problem with apps having carte-blanche access to your personal data 24/7. There is nothing that the TikTok app does that any other app cannot also do. It seems nobody wants to make that connection. There should be real protections for consumers to prevent ANY application from slurping up this data, and I don't mean just a disclosure or system setting to hamstring the application into uselessness. I mean, there should be regulations preventing the collection of this data in the first place, with hefty fines and punitive damages.
  - eternityforest 4y ago
    Most privacy advocates probably do plenty of things I would be perfectly happy to see made illegal, but we don't just ban them because we don't want a complete dictatorship of one segment of the population over everyone else, and because it seems the people realize it would cause problems for some people, and we need to be careful to find suitable replacements before we ban things. A lot of the tech I imagine you are referring to has been life changing for me, and if it cost normal SASS prices would not be affordable. Regulations and disclosures are good, but a straight ban would (depending on how it was written) quite likely affect services that inherently require mass data collection, like Tile trackers, and might make other services have to do subscriptions and become unaffordable for many. If there was a state sponsored Pine64 style company that could do all of what Google does for the same price without spying, it would be great. But at the moment, the FOSS community does not have true equivalents, or the budget or interest to do so, nor the marketing power to do the stuff that only works if everyone else uses it, and the non-spy commercial solutions have many of the same issues and cost too much for low income people.
chaxor 4y ago
Most spyware is installed by the user themselves. It's typically called "security software" from your company, or the VPN they provide (which also includes additional software that backdoors your entire device).
- Antiks99 4y ago
  [flagged]
gonehome 4y ago
Apple has “Advanced Data Protection” that you can enable This was built after the NSO group hacks to lock down the device to be resilient to nation state attacks. It limits some of the attack vectors you’re taking about (with a tradeoff of also limiting some features). Apple also enabled true e2ee in the cloud where only you retain the keys.
- irobeth 4y ago
  > Apple also enabled true e2ee in the cloud where only you retain the keys. Is there a procedure to realistically verify that your communications are e2e and not e2mitm2e ?
  - walterbell 4y ago
    Canary content for your threat-modeled attacker, then monitor for the data being acted upon, e.g. traffic to non-public URL.
  - chaxor 4y ago
    All of it is a bit silly to trust companies with things like this when there are standard techniques which have stood the test of time and are *far* simpler - tar.zst.gpg or squash.gpg, luks-encrypted qemu images, etc. Things done locally are just inherently better, because it's far simpler tech, and you actually know what's happening rather than just blindly trusting some sketchy company.
humanistbot 4y ago
A university PR office puts out a press release that is shallow version of the actual paper? Why I never....
AtlasBarfed 4y ago
Oh here, let me run it down real quick. You don't even need to be an expert. Tracking cookies, browser fingerprinting, and ISP-level monitoring logs everything you do. Various consumer database warehouses hoover up the data for resale/targetting by ad companies Hint: once a business has it, at a minimum the FBI/CIA/Government has it. Likely, they've been hacked by China and Russia too. In addition, the CIA/FBI run ISP-level and DC-level monitoring/hoovering. Finally, there is no oversight. Either the FBI will cookie cutter whatever request they need after the fact to the rubber-stamp-anyway kangaroo oversight "Court", or they won't even bother. The CIA doesn't even need to care. The only limitation of widespread abuse is some sense of patriotism in the CIA/FBI, and of course that is pretty simple to frame/justify as needed. The bottom line is that there is a 100% turnkey total information awareness infrastructure for any authoritarian regime that takes over the US government (see: Iraq war, false flag attacks, McCarthyism, etc). They know everyone you communicate with, your political views, your buying habits, and they will soon have AI software to maximize usitlization of the firehose for profiling, reeducation camps / gulags, and the like. The US government can deny you civil rights by declaring a US citizen an enemy combatant, and are more than willing to setup concentration camps for immigrants, and therefore "terrorists".
- barrysteve 4y ago
  God's all-seeing presence is a preservative against sin and a means to make you watchful over all your ways and actions. - Thomas Gouge It was always the intent to make sight of citizens completely transparent.
- BenFranklin100 4y ago
  Exactly three years ago I would have laughed at you, but three years of COVID has taught me that the powers that be in our society — which include journalists, academics and moderators of online forums — will happily help tear down essential liberties for perceived, small, and temporary safeties. The abuses stemming from a lack of privacy have not been realized because of political convictions, but because of technical limitations. The advent of advanced AI models will remove many of these technical limitations and allow corporations and governments to quickly build detailed profiles of every citizen that touches the internet.
KingLancelot 4y ago
[dead]
tptacek 4y ago
This is a standard university press-release style article about a paper accepted at PETS: https://www.sysnet.ucsd.edu/~voelker/pubs/spyware-pets23.pdf https://www.sysnet.ucsd.edu/~voelker/pubs/spyware-pets23.pdf It's academic research, so this thread here expressing disappointment about the article is weird. We should probably just replace the press release with a link to the study itself. From the abstract: . In this work, we perform an in-depth technical analysis of 14 distinct leading mobile spyware apps targeting Android phones. We document the range of mechanisms used to monitor user activity of various kinds (e.g., photos, text messages, live microphone access) — primarily through the creative abuse of Android APIs. We also discover previously undocumented methods these apps use to hide from detection and to achieve persistence.
1vuio0pswjnm7 4y ago
Flip phones are available. SBF has been issued with one under his latest conditions of release. Remember though, privacy comes at a cost. Thousands of parasitic "startups" that live off of VC, produce nothing for sale, have no profits and rely on surveillance to demonstrate speculative "value" might suffer or even "go out of business", "Big Tech" might not rake in billions per quarter for selling ad services, "tech jobs" might be lost. It could be catastrophic. The entire economy could crash. It could put an AI-driven utopian future at risk. All because of the desire to maintain privacy. This is not just another HN comment conatining only FUD or hype-based predictions with zero factual support. "We take privacy seriously." It's threat to what we do. As an "industry" it's vital that we maintain peoples' trust while we surveil them. /s
- teddyh 4y ago
  Your quoting of certain words seem odd. https://prestersperspective.blogspot.com/p/schizophrenia-randomly-capitalized-words.html https://prestersperspective.blogspot.com/p/schizophrenia-ran...
  - mjfl 4y ago
    It's because he was using sarcasm, which you failed to detect.
    - teddyh 4y ago
      I probably failed because the quoted words were not actually quotes. I could understand a word like “value” being quoted sarcastically without a specific quote in mind, but the quoting of many other words and phrases were mystifying.
      - marttt 4y ago
        Try to replace OPs quotes with an appositive like so-called or so to say. "Big tech" = so-called Big Tech, "industry" = so-called industry etc. This way, the irony does make sense, especially when you read OPs earlier comments.

TheRealDunkirk 4y ago

> I value privacy more than the ability to order food through my phone. I know you didn't mean it like this, but I find it funny that it reads like we've abandoned the idea of calling a restaurant and just talking to a person to order takeaway.

walterbell 4y ago
> talking to a person to order takeaway Also supports small business by saving them double-digit app fees!
- Jeremy1026 4y ago
  Not necessarily. The delivery apps set up proxy numbers to pass calls through, taking a lead fee. So you can't just search "sub shop near me" and call, as it might not be their actual phone number. Your best bet if you want to save the local place fees from the apps is walk in the first time, then call the number off the paper menu from then on.
  - xeromal 4y ago
    If they have a website, that's usually a good number too
  - walterbell 4y ago
    PiTM (Parasite in The Middle)
- scarface74 4y ago
  I know a couple of small restaurant owners. Even ones that don’t go through UberEats or GrubHub that use SaaS restaurant software that also come with a white labeled restaurant specific app that accepts Apple Pay (standard credit card fees - not 30%) and other payment methods. They actually prefer it.
  - SoftTalker 4y ago
    Weird. The small places here (I'm thinking chinese take-out, for example) take cash only, order tickets are on paper, they don't deliver, and seem to be thriving. Have the Uber Eats and other tech middlemen started taking such a big slice of the profit that it's not worth it? Having worked in a restaurant, if someone took 30% of my gross it certainly would have been all of my profit and then some.
    - walterbell 4y ago
      NYC currently caps fees at 20%. Grubhub is lobbying for 30%. https://www.restaurantbusinessonline.com/technology/nyc-could-ease-its-20-delivery-fee-cap https://www.restaurantbusinessonline.com/technology/nyc-coul... > New York, like many cities, put a limit on third-party delivery fees during the pandemic to help restaurants that had come to depend heavily on the service. Last August, it became one of the few jurisdictions to make the emergency measure permanent ... Last year, it passed a first-of-its kind law that would force delivery providers to share more customer data with restaurants.
    - scarface74 4y ago
      I just said the opposite. Restaurants apps do not pay 30% even when going through the App Store. It’s a physical good and even if they do accept Apple Pay, they get charged standard credit card processing fees - $0.25 + 2-3% of the amount. I said they do not use GrubHub. They have their own system run as SaaS. The company they use takes care of the POS system, merchant accounts, and a white labeled app just for their store.
      - walterbell 4y ago
handedness 4y ago
Many restaurant managers already have: I'm increasingly finding places won't allow phone orders, at least during peak hours.
- SoftTalker 4y ago
  So call the places that do. This is called free market competition.
  - msm_ 4y ago
    But why? Ordering via app is more convenient, and the restaurants clearly don't mind fees.
A4ET8a8uTh0 4y ago
<< just talking to a person to order takeaway. The sad thing is that even if you do that, the restaurants are now almost guaranteed to use your phone as unique identifier and use that data for, hopefully, their own purposes ( hopefully, because the lure of selling data might be too much ).
- walterbell 4y ago
  It's good privacy practice to use cheap and disposable VOIP numbers for online/phone shopping, changed periodically.

moremetadata 4y ago

[dead]

sizzle 4y ago

You can read the whole paper shared by another HN user here: https://petsymposium.org/popets/2023/popets-2023-0013.php https://petsymposium.org/popets/2023/popets-2023-0013.php PDF Paper: https://petsymposium.org/popets/2023/popets-2023-0013.pdf https://petsymposium.org/popets/2023/popets-2023-0013.pdf

Liquix 4y ago

I was hoping it would raise the alarm regarding Google and Apple's overreaching, always-on data collection practices. 99% of people don't need to worry about an attacker gaining physical access to their unlocked device and installing an application. We as a society do need to worry about tech giants amassing enough data on us to gain an insurmountable AI-training-data advantage which makes them too useful as tools of the state to be regulated by said state. The irony of pointing out how to spot a "spyware" app disguised as a WiFi icon when the dozen Big G apps pictured alongside are collecting the same data...

YeahNO 4y ago
You would think the panic over TikTok spying would illuminate the problem with apps having carte-blanche access to your personal data 24/7. There is nothing that the TikTok app does that any other app cannot also do. It seems nobody wants to make that connection. There should be real protections for consumers to prevent ANY application from slurping up this data, and I don't mean just a disclosure or system setting to hamstring the application into uselessness. I mean, there should be regulations preventing the collection of this data in the first place, with hefty fines and punitive damages.
- eternityforest 4y ago
  Most privacy advocates probably do plenty of things I would be perfectly happy to see made illegal, but we don't just ban them because we don't want a complete dictatorship of one segment of the population over everyone else, and because it seems the people realize it would cause problems for some people, and we need to be careful to find suitable replacements before we ban things. A lot of the tech I imagine you are referring to has been life changing for me, and if it cost normal SASS prices would not be affordable. Regulations and disclosures are good, but a straight ban would (depending on how it was written) quite likely affect services that inherently require mass data collection, like Tile trackers, and might make other services have to do subscriptions and become unaffordable for many. If there was a state sponsored Pine64 style company that could do all of what Google does for the same price without spying, it would be great. But at the moment, the FOSS community does not have true equivalents, or the budget or interest to do so, nor the marketing power to do the stuff that only works if everyone else uses it, and the non-spy commercial solutions have many of the same issues and cost too much for low income people.

chaxor 4y ago

Most spyware is installed by the user themselves. It's typically called "security software" from your company, or the VPN they provide (which also includes additional software that backdoors your entire device).

Antiks99 4y ago
[flagged]

gonehome 4y ago

Apple has “Advanced Data Protection” that you can enable This was built after the NSO group hacks to lock down the device to be resilient to nation state attacks. It limits some of the attack vectors you’re taking about (with a tradeoff of also limiting some features). Apple also enabled true e2ee in the cloud where only you retain the keys.

irobeth 4y ago
> Apple also enabled true e2ee in the cloud where only you retain the keys. Is there a procedure to realistically verify that your communications are e2e and not e2mitm2e ?
- walterbell 4y ago
  Canary content for your threat-modeled attacker, then monitor for the data being acted upon, e.g. traffic to non-public URL.
- chaxor 4y ago
  All of it is a bit silly to trust companies with things like this when there are standard techniques which have stood the test of time and are *far* simpler - tar.zst.gpg or squash.gpg, luks-encrypted qemu images, etc. Things done locally are just inherently better, because it's far simpler tech, and you actually know what's happening rather than just blindly trusting some sketchy company.

humanistbot 4y ago

A university PR office puts out a press release that is shallow version of the actual paper? Why I never....

AtlasBarfed 4y ago

Oh here, let me run it down real quick. You don't even need to be an expert. Tracking cookies, browser fingerprinting, and ISP-level monitoring logs everything you do. Various consumer database warehouses hoover up the data for resale/targetting by ad companies Hint: once a business has it, at a minimum the FBI/CIA/Government has it. Likely, they've been hacked by China and Russia too. In addition, the CIA/FBI run ISP-level and DC-level monitoring/hoovering. Finally, there is no oversight. Either the FBI will cookie cutter whatever request they need after the fact to the rubber-stamp-anyway kangaroo oversight "Court", or they won't even bother. The CIA doesn't even need to care. The only limitation of widespread abuse is some sense of patriotism in the CIA/FBI, and of course that is pretty simple to frame/justify as needed. The bottom line is that there is a 100% turnkey total information awareness infrastructure for any authoritarian regime that takes over the US government (see: Iraq war, false flag attacks, McCarthyism, etc). They know everyone you communicate with, your political views, your buying habits, and they will soon have AI software to maximize usitlization of the firehose for profiling, reeducation camps / gulags, and the like. The US government can deny you civil rights by declaring a US citizen an enemy combatant, and are more than willing to setup concentration camps for immigrants, and therefore "terrorists".

barrysteve 4y ago
God's all-seeing presence is a preservative against sin and a means to make you watchful over all your ways and actions. - Thomas Gouge It was always the intent to make sight of citizens completely transparent.
BenFranklin100 4y ago
Exactly three years ago I would have laughed at you, but three years of COVID has taught me that the powers that be in our society — which include journalists, academics and moderators of online forums — will happily help tear down essential liberties for perceived, small, and temporary safeties. The abuses stemming from a lack of privacy have not been realized because of political convictions, but because of technical limitations. The advent of advanced AI models will remove many of these technical limitations and allow corporations and governments to quickly build detailed profiles of every citizen that touches the internet.

KingLancelot 4y ago

[dead]

tptacek 4y ago

This is a standard university press-release style article about a paper accepted at PETS: https://www.sysnet.ucsd.edu/~voelker/pubs/spyware-pets23.pdf https://www.sysnet.ucsd.edu/~voelker/pubs/spyware-pets23.pdf It's academic research, so this thread here expressing disappointment about the article is weird. We should probably just replace the press release with a link to the study itself. From the abstract: . In this work, we perform an in-depth technical analysis of 14 distinct leading mobile spyware apps targeting Android phones. We document the range of mechanisms used to monitor user activity of various kinds (e.g., photos, text messages, live microphone access) — primarily through the creative abuse of Android APIs. We also discover previously undocumented methods these apps use to hide from detection and to achieve persistence.

1vuio0pswjnm7 4y ago

Flip phones are available. SBF has been issued with one under his latest conditions of release. Remember though, privacy comes at a cost. Thousands of parasitic "startups" that live off of VC, produce nothing for sale, have no profits and rely on surveillance to demonstrate speculative "value" might suffer or even "go out of business", "Big Tech" might not rake in billions per quarter for selling ad services, "tech jobs" might be lost. It could be catastrophic. The entire economy could crash. It could put an AI-driven utopian future at risk. All because of the desire to maintain privacy. This is not just another HN comment conatining only FUD or hype-based predictions with zero factual support. "We take privacy seriously." It's threat to what we do. As an "industry" it's vital that we maintain peoples' trust while we surveil them. /s

teddyh 4y ago
Your quoting of certain words seem odd. https://prestersperspective.blogspot.com/p/schizophrenia-randomly-capitalized-words.html https://prestersperspective.blogspot.com/p/schizophrenia-ran...
- mjfl 4y ago
  It's because he was using sarcasm, which you failed to detect.
  - teddyh 4y ago
    I probably failed because the quoted words were not actually quotes. I could understand a word like “value” being quoted sarcastically without a specific quote in mind, but the quoting of many other words and phrases were mystifying.
    - marttt 4y ago
      Try to replace OPs quotes with an appositive like so-called or so to say. "Big tech" = so-called Big Tech, "industry" = so-called industry etc. This way, the irony does make sense, especially when you read OPs earlier comments.