7 ms·
PcTattletale leaks victims' screen recordings to entire Internet
- junniper 2y agoYeesh. Is it still considered a “vulnerability” if the door is built without locks? Or even a handle.
- ronsor 2y ago"What door?"
- junniper 2y agoDoors with locks are often a metaphor for security. In this case the “door” is this company’s API. Considering the context of the original post what did you think my comment meant?
- BobaFloutist 2y agoTheir joke was that the security is so poor, it could even be conceived as a doorway they never put a door in. They were playing off your comment and agreeing by exaggerating further.
- junniper 2y agoYou’re right! Now I feel silly for missing the joke.
- deleted 2y ago[deleted]
- rinze 2y agoIs that the codename for Windows 11?
- ronsor 2y agoBased on the functionality, I'd think it's the codename for "Copilot Plus" or whatever it's called now.
- supernes 2y agoWhat a wild story. From one of the linked reports: > it took Fleming over 20 hours to take the defaced website offline, but the long time was not for lack of trying: his own spyware recorded him clumsily attempting to restore the site fairly early on but ultimately failing to do so. while pcTattletale itself has now been entirely down for a few hours, the sending of screenshots to the s3 bucket continued until Flemings aws account was locked down by amazon shortly before publishing this article.
- deleted 2y ago[deleted]
- e_daigle 2y agoI'm the author of the blog post - the exploit is so simple it kind of speaks for itself, but if anyone has any questions feel free.
- sizzle 2y agoThanks for the write up
- buran77 2y agoThe even more worrying thing for anyone considering any solutions which do such mass surveillance, regardless of motive (like Windows Rewind). They're all one or two steps removed from massive scale access to these recordings. All of the steps have happened repeatedly in the past. The only way to be safer is not keep that data in the first place. > the tiny shell lets anyone execute abitrary php code by simply setting a cookie. what makes this file such an interesting find, though, is that the shell has been present since at least december 2011 (which is when the site got moved to its current server). it is impossible to tell whether this shell was placed there by pcTattletale (for whatever reason) or by a threat actor; either way, it reveals that pcTattletale has been backdoored for basically forever and may have had data exfiltrated from it for years by external actors
- dgellow 2y agoWindows Recall is stored locally and encrypted from what I understood
- dorkwood 2y agoYes. I've heard it's unhackable. We are in good hands.
- WhackyIdeas 2y agoFor anyone downvoting this person, keep in mind they are quite obviously being sarcastic……
- buran77 2y agoUntil a year or two later when MS rolls out the feature of "AI" on "your data". Or gives the option/default to store the recording on OneDrive. Or any number of options that MS can monetize somehow while selling it as a benefit for you. How many massively popular feature requests sit on the waiting list every day while this one comes out of the blue despite almost no user ever asking for it, and it's for you? Rewind is the house's foundation, the rest of the walls come later. How fast they come depends on what the CEO sees as the future of making money. Having these recordings is a liability more than it is a productivity boost. People today don't operate computers under the assumption they are recorded at all times even if they know the feature is there. So of course it's dangerous. One day, when you'll be thoroughly used to being surveilled at all times, having Rewind-like features will be as ubiquitous or as normal as walking around today with a GPS tracker, microphone and spy cam in your pocket, for someone else to use. Something equally unacceptable some decades ago.
- urbandw311er 2y agoSo 17Tb of screenshot data from the last 7 years is doing the rounds in the wild? An AI will have a field day extracting whatever kinds of specific juicy details an attacker could ever want. “Give me a list of all the credit card numbers” “Give me any emails where somebody is asking a lawyer to block publication of something” Etc
- squigz 2y agoI don't think the AI's day is going to be any different, really.
- araes 2y agoNotably other issues (from the publisher): > pcTattletale is a discreet and powerful tool that records and shows you the online activities of your employees and children. (emphasis mine) Work computers with work secrets and children's computers with children's data. 17,000,000,000,000 bytes of such data. Maybe 5,000,000 screens if it was "normal" cell images. (Based on say a 3 MB screen, which might be large. If it's all XGA, or SXGA, or something, it may be way more screens.)
- rgmerk 2y agoThis kind of thing has happened repeatedly, but kinda misses the point. Stalkerware is designed and built as a tool of abuse. The people who create it are looking to profit off that abuse. More effort should be devoted to prosecuting these bottom-feeders.
- TiredOfLife 2y agoUS and other countries are moving to classify more and more things as "not a crime" like car theft or shoplifting. So don't hold your hope up.
- ziddoap 2y agoCan you back this up somehow? I haven't heard of or seen anything indicating that the US, or any other country, is trying to make car theft or petty theft legal.
- halfcat 2y agoThey’re probably referring to situations in California where people walk out with merchandise because the penalties are less than the merch they’re getting. It’s less of a “the way things are headed” in the US, and more of a side effect of the state-level political games each side is playing, where blue states score points by loosening penalties, and red states score points by tightening penalties. Neither population of state citizens is right or wrong, but rather they’re all pawns. As someone put it, the politicians have organized the country into two LARPing teams to keep everyone distracted while they run out the back door with the money.
- mk67 2y agoFrom what I read it's not prosecuted in San Francisco e.g. anymore.
- antifa 2y agoThey're just derailing to what about their unrelated political grandstand.
- 2y ago
- badgersnake 2y agoAll the users password hashes (in MD5, so basically their plaintext passwords) got leaked as well.
- mmsc 2y agowhat makes this file such an interesting find, though, is that the shell has been present since at least december 2011 It's really easy to change the creation date of a file by changing the system clock for a millisecond, and create a file, before changing the clock back to normal. Some people like to do this to avoid their back doors being found by IR doing a "find" for any newly created files.
- zaxomi 2y agoNo need to change the system clock for a millisecond. The operating system has an API for changing allt the timestamps of a file.
- vitus 2y agoIndeed, that's what `touch -t 201101020304 /tmp/old-file` is for. (Although on ext4 it seems that you can't control the birth time; for that you would need to set your system clock.)
- gigatexal 2y agoJust in time for Microsoft Rewind or whatever it’s called.
- userbinator 2y agoUnfortunately there are 86400 timestamps per day, so enumerating this across all days and all devices would take forever. Instead we'll use a heuristic: we'll start with the last screenshot and subtract one second at a time, downloading from each and seeing if we get a valid photo or the error XML that comes up if no screenshot was taken at that second. If we get the error XML 20 times in a row, we'll assume the recording is over and give up. Binary search?
- abtinf 2y agoThis, and the other stalkerware linked to in the article, is what everyone on iOS can look forward to thanks to the EU.
- EMIRELADERO 2y agoCare to elaborate? I thought Chat Control laws and similar were deemed "unconstitutional" by the ECHR
- abtinf 2y agoSideloading.
- wackget 2y agoYou mean the ability to install your choice of software on a device that you own is dangerous????? Someone should tell the authors of literally every other operating system ever made about this astonishing discovery!
- abtinf 2y agoThey should. Every major platform has this issue pervasively, except for iOS. People like you have decided that you own my phone, not me. You get to tell me and Apple how I have to use my phone, just because you don’t like that my choice of software is a locked down device.
- VS1999 2y agoYou don't have to use your phone any way. Just don't download something if you don't want it, silly.
- skeaker 2y agoYou act like Pegasus [0] and jailbreaking in general didn't exist until recently. [0] - https://en.wikipedia.org/wiki/Pegasus_(spyware) https://en.wikipedia.org/wiki/Pegasus_(spyware)
- justin_oaks 2y ago> the pcTattletale client api returns raw aws credentials. it's intended to allow screenshots to be directly uploaded to the storage bucket, which is already terrible enough on its own, but it's worsened by the fact that these credentials are the same for all devices and provide full unscoped access to Fleming's aws infrastructure (From the Maia arson crimew blog post linked in the article) This is my favorite part of the story. This is one of the worst decisions you can make when developing an app that uses cloud resources. It's so pathetic that it makes me wish that we could revoke someone's license to write code.
- halfcat 2y agoIt appears that this is installed to the path below on Windows, if you want to check if it’s running on your PC: C:\Program Files (x86)\Common Files\Microsoft Shared\scheduler Using one of these executable names: mssched.exe jusched32.exe
- imchillyb 2y agoMy Grandfather: "Don't write anything down that you don't want others to see." Those words have been with me since I was 8 years old. The truth of them resounds throughout history, and well into the distant future. Ignore them at your peril.
- mariceldaiza 2y ago[dead]