10 ms·
US and UK spy agencies scoop up private data from 'leaky' phone apps
- falcolas 13y agoAnymore, it seems prudent to simply assume that if you use the internet at all, all of the details about you are available to determined individuals, public or private. Even details you've never consciously given out over the internet are available to those with the power and desire to infer from your browsing datasets (see: Target and the pregnant daughter). Someone, please tell me I'm wrong.
- electic 13y agoYou are not wrong sadly. There are too many leaky apps, platforms, and technologies.
- Learjet 13y agoYou are dead on.
- sp332 13y agoSomehow, people were able to convince users that something on the internet could be secure. Nothing on the internet is secret, that's not what the internet is for.
- gatehouse 13y agoAnd it follows that if you build internet technology, you are also building surveillance infrastructure.
- aryastark 13y agoI'm afraid it's much worse than that, even. You don't even need to use the internet. You can be walking down the street and an hour later, unbeknownst to you, your picture makes it to the front page of reddit. It could be that you were skipping work that day, and told your boss you were sick. Or perhaps picking up an engagement ring. This sort of free-for-all will only get worse as technologies like Google Glass and the so-called "Internet of Things" become mainstream. Your life is now a commodity for internet voyeurism and, possibly, witch hunts. The tech is ripe for turning citizens against citizens. "Turn in your neighbor for un-American activities" sort of stuff.
- seanr 13y agoThere ought to be more emphasis that these documents are circa 07/08. HTTPS websites were an oddity back then.
- Karunamon 13y agoIndeed! 2008 is 5+ years ago. 5 years in tech is a couple of eternities.
- thematt 13y agoOn both sides. You should assume they have broader and deeper capabilities now.
- joshfraser 13y agoThus their obsession with undermining public key encryption and obtaining the private keys for popular services.
- nly 13y agoAFWall+ doesn't hurt, if you can get the damn thing to work (I seem to have issues with loads of apps that require root on my Nexus 4) https://play.google.com/store/apps/details?id=dev.ukanth.ufirewall https://play.google.com/store/apps/details?id=dev.ukanth.ufi...
- Learjet 13y agoRidiculous,seems like they are taking data and storing it and waiting to get subpoenas to look into and analyze the data later. Welcome to the new world order where your every movement is known.
- er35826 13y agoDon't be alarmed citizen. They only 'know' about your movements if they actually look at them. Until then, they don't 'know' anything as long as it sits in their archives untouched.
- greenrice 13y agoFor now. Just wait until sophisticated AI is developed...
- uloweb 13y agoyeh, time to use simple nokia phones again.
- brokenparser 13y agoTime to use tin cans again.
- flurpitude 13y agoJust be very careful not to do anything that might give them reason to "know" about you. Such as holding impermissible political views or knowing too much about computers, to pick two random examples.
- ryoshu 13y agoIt's a bit more Orwellian than that. The NSA claims it doesn't "collect" data until it looks at the data. Somehow the data magically appears in its databases, but it isn't collected.
- 13y ago
- fit2rule 13y agoThe only solution is to move to a phone OS that is 100%, completely, open. I.e. Not even apps developers are allowed to ship blobs - its All-Source-Code, All-The-Time. I know, its a highly unlikely scenario, but I can't help but feel in the midst of this human rights disaster, Open Source can come to the rescue.
- falcolas 13y agoNot just the OS, but the entire phone, chipset -> firmware -> os (including wireless sub-OSes) -> app. Of course, if your open source apps request any data related to your activities (such as detailed map data about your current location, even without your exact location, or routing information for TCP packets), you're leaking data about yourself again.
- joosters 13y agoThat's not enough. Take the Google maps example, for instance. I bet the NSA could grab the same data from an open-source map app that used OpenStreetMap data. They can infer your location based upon the set of map tile URLs that your phone is loading over the network. No need for any code weaknesses in the app. Open source is not your saviour here!
- pgeorgi 13y agomany OSM apps provide offline vector data. works without data connection and also leaks less information - the most you can infer from those downloads is that people are interested in mapping data of a certain area.
- jonknee 13y agoThe baseband is the problem. It leaves even a 100% open source OS quite vulnerable.
- 6d0debc071 13y agoIf people don't read and understand the code, ideally before running it since part of the code might be to make some low level change to its environment and then erase itself, then it doesn't matter whether it's there or not. And reviewing significant code bases is not something one person can do on their own, even in the unlikely event they've all the specialities to understand it all. It would require non-trivial organisations to be directed towards auditing the applications/system to ensure security. Which isn't to say that I don't think open source is a necessary condition for security. But I don't see that sort of audit getting done for everything that your average user is going to run on their phone.
- suprgeek 13y agoMany interesting "nuggets" buried in this report. For example: ...A more sophisticated effort, though, relied on intercepting Google Maps queries made on smartphones, and using them to collect large volumes of location information. So successful was this effort that one 2008 document noted that "[i]t effectively means that anyone using Google Maps on a smartphone is working in support of a GCHQ system." At this point it is perhaps not wrong to conclude that the whole internet is bjorked by these agencies. Open to snooping and manipulation at any and every level for any user. It is time for a reboot, this time with much more focus on security.
- seanr 13y agoMaps and other apps on the iPhone weren't using HTTPS in 08 (underpowered device, need to squeeze every last drop from battery). They do now however. It's not just a spy agency issue, anyone could have sniffed the unencrypted traffic.
- streetnigga 13y ago(underpowered device, need to squeeze every last drop from battery) Really now? Is that the official reasoning for not using HTTPS?
- TeMPOraL 13y agoWell, this is the most common argument before Snowdengate I heard against using HTTPS anywhere, not only on mobile devices.
- seanr 13y agoBack then it was.
- streetnigga 13y agoI just don't recall anything official regarding that line of thought. Direct PR or otherwise. Is there any examples off the top of your head?
- fredgrott 13y agoCurious, how many app devs are doing security/permissions audits? On Android java side we have a tool called: sable/soot Which I am recently learning to use..
- pydave 13y agoYou mean this: https://github.com/Sable/soot https://github.com/Sable/soot ? > Soot is a Java optimization framework Seems to be a Java static analysis tool and not related to Android permissions (although maybe related to security).
- CWuestefeld 13y agoOne slide from a May 2010 NSA presentation on getting data from smartphones – breathlessly titled "Golden Nugget!" – sets out the agency's "perfect scenario": "Target uploading photo to a social media site taken with a mobile device. What can we get?" To me, this is quite telling. The NSA is not considering what data they need to achieve their mission, and then trying to find that data. Instead, they're just looking for "what can we get", and worry later about how it might be useful (or legal!). This is no way to run a successful organization in the 21st century.
- deleted 13y ago[deleted]
- rdl 13y agoWhy not? It is technically feasible. There was essentially no legal oversight at NSA or GCHQ. It seems like they responded correctly to the incentives they were given. The problem is with the legislature (and the judiciary), voters, and the media.
- streetnigga 13y agoMurdering people is technically feasible as well. If entities are given essentially no legal oversight then the correct response would be to act on the incentives they were given to murder freely. The problem is with the legislature (and the judiciary), voters, and the media.
- john_b 13y agoI don't think the parent was trying to absolve the NSA of responsibility, merely pointing out that its mission incentivizes it to collect as much data as it can. It's ultimately the responsibility of Congress to ensure that the NSA and other intelligence agencies adhere to the law, and Congress has largely ignored this responsibility. The more subtle point that the parent makes is that, rather than always trying to prevent bad actors from doing bad things (e.g. murdering), a working system of checks and balances can punish the bad actors and deter future abuses. But checks and balances obviously don't work when everything is classified. The legislature and the judiciary were essentially the only two institutions that had access to this information and they did nothing about it. You can't vote judges out of office, but if large scale surveillance is an issue important to you I'd make sure my congressman or congresswoman knew about it.
- cryoshon 13y agoSo they're spying on the children playing Angry Birds in the name of preventing terrorism. I bet the data they're gathering has saved a lot of lives. This is just one more strike into the already well-beaten dead horse of an argument that the NSA is spying in the name of preventing terrorism. I will spell it out: the goal of the NSA surveillance is omniscience in the name of preserving the power of the state. They have made great progress toward this ideal.
- ommunist 13y agoWhat about leaking bookmarks from Al-Quran app?
- cryoshon 13y agoStill a ridiculous unneeded incursion onto an individual's right to be left alone when they aren't hurting anyone. As violent and primitive as the Islamic fundamentalists are, the vast, vast, vast majority of the world's 1.6 billion Muslims are not fundamentalists, nor are they terrorists, nor do they aid terrorists. The phrases that people bookmark in a religious app book are a very far cry from demonstrable intent to commit violence, anyway. If you spied on everyone's bookmarks in religious text apps, I'm fairly certain that if you pitched it properly you could depict my own gentle mother as a genocidal crusader.
- Crito 13y agoWhile I would agree that the "vast, vast, vast" majority of Muslims do not present a threat to national security, it is going too far to say that the "vast, vast, vast" majority are not fundamentalists. The majority are almost certainly not, but a frighteningly large minority are. For example, only 54% of Muslims in Turkey believe that suicide bombings are never justified, and 16% believe that they are sometimes or often justified: http://www.pewglobal.org/2013/09/10/muslim-publics-share-concerns-about-extremist-groups/#suicide-bombing http://www.pewglobal.org/2013/09/10/muslim-publics-share-con... This should not be particularly surprising. Fundamentalism also runs strong in Christianity. Nearly half of all Americans are creationists, believing that the earth is only a few thousand years old, and that people did not evolve (we're not talking Catholic-style "god used evolution" creationism here, we're talking straight up "literal talking snake" creationsim): http://www.gallup.com/poll/155003/hold-creationist-view-human-origins.aspx http://www.gallup.com/poll/155003/hold-creationist-view-huma... People take religion seriously, film at 11.
- ommunist 13y agoHmmm.... I can see how open source app can exist on githib and in your iTunes if you have Developer Account. But can you be sure it is 100% open source once it went through the AppStore gates? I am just asking.
- rimantas 13y agoCan you be sure about that for any binary you did not compile yourself? And if being more paranoid: can you be sure about that for any binary you did not compile yourself using compiler you compiled yourself?
- ommunist 13y agoThat is exactly my point. Thank you for understanding.
- dublinben 13y agoNo, you really can't.
- hackoder 13y ago(Copied from https://news.ycombinator.com/item?id=7132790 https://news.ycombinator.com/item?id=7132790) If you're using Android, I'd highly recommend using a combination of XPrivacy [1] and Android Firewall [2] (iptables frontend). To make your life easier, disallow everything from accessing the net in Android Firewall. Then, for those apps which you've allowed net access, further tweak what they're allowed to access in XPrivacy. As a rule, turn off account info, clipboard, location, contacts, and storage. Not perfect, but a decent solution. [1] https://github.com/M66B/XPrivacy https://github.com/M66B/XPrivacy [2] https://play.google.com/store/apps/details?id=com.jtschohl.androidfirewall https://play.google.com/store/apps/details?id=com.jtschohl.a...
- fulafel 13y agoBetter yet, only use Android as a game console / YouTube viewer with no personal info or real Google ID. Web browsing only through Firefox that can use some privacy addons.
- CryptcWriter 13y agoIs any of this really a surprise to any of you?
- downer81 13y agoThat's like walking up to an astronomer, and when he gives detailed remarks regarding the stars in the sky, you reply: You're really surprised that there are stars in the sky? I think you're missing the point.
- winslow 13y agoI'm sure they are finding and identifying tons of "terrosim threats" by looking at angry birds data... /s If anything they are just making it harder to find the needle (terrorist threat) in the haystack (their dragnet of data). At the end of the day maybe they don't care about finding the needle anymore.
- JoeAltmaier 13y agoAll kinds of data are interesting. You've seen episodes of CSI. Position data scraped from some app, any app, can come in useful but only when you want to track somebody. Who to track is a different problem. Its not all about finding criminals. But when you've found one, you want to know where he's at, who he's associating with etc.
- winslow 13y agoAbsolutely data is interesting. However, just because it is interesting doesn't mean it is useful to catch a terrorist. The US Government / NSA is creating more enemies then it is "catching" right now. Since when did the American citizen become the default criminal especially one that commits act of terrorism?
- minimax 13y agoExploiting phone information and location is a high-priority effort for the intelligence agencies, as terrorists and other intelligence targets make substantial use of phones in planning and carrying out their activities, for example by using phones as triggering devices in conflict zones. That's a good point and a good reason why it's irresponsible for these newspapers to post the details about this technology. This kind of CI doesn't work as well once everybody knows what you're doing. It also gives a road map to more oppressive governments looking for ways to spy on their citizens. The documents do not make it clear how much of the information that can be taken from apps is routinely collected, stored or searched, nor how many users may be affected. Right, so this is just publishing some details of NSA/GCHQ counterintelligence technology without saying how they are using it. Unless they have some evidence of wide scale deployment of these techniques, how is this surprising? Do we not expect spy agencies to develop surveillance technology?
- 00rion 13y agoIf the government offered a legitimate and effective way for whistleblowers to expose wrongdoing and unconstitutional behavior, perhaps they could limit this type of damage from being done. As it stands, the release of this information could be considered collateral damage as result of their continued persecution of whistleblowers.
- minimax 13y agoThe people who are harmed by making this information public is not the U.S. government. Think it through. Who wins by knowing how the US government conducts targeted counterintelligence operations? That will be primarily terrorists, organized crime, and oppressive governments. So then who loses? That will naturally be victims of terrorism, organized crime, and oppressive governments. That is why I don't think it's responsible to go around publicizing every little detail about NSA/GCHQ CI techniques and technology.
- 00rion 13y agoI don't think you're being very clear. The victims of terrorism generally don't have access to the information that these counterintelligence operations obtain. In other words, the victims are in the same place they were before they knew what the NSA was capable of. What I think you're saying is doublespeak. To paraphrase your argument, "Snowden is doing damage to our counterintelligence capabilities by releasing this information. Also, Snowden isn't doing any damage to the government." These statements contradict one another.
- pirateking 13y agoThe only fix to our information, privacy, and security pop culture is destroying the whole system, and building a new one holistically with a focus on security and education at the lowest levels of the system. This almost certainly means destroying computing as we know it as a prerequisite. “Once you have something that grows faster than education grows, you're always going to get a pop culture.” - Alan Kay
- username223 13y agoBetween this and the recent credit card and identity leaks by Target and others, I really wish people would connect the dots. If companies are grabbing and storing incredible amounts of information about millions of people, that information will inevitably get the attention of spammers, scammers, stalkers, criminals, governments, and anyone else who could possibly put it to use. The solution is to limit what companies collect in the first place.
- acd 13y agoI will quote United nations declaration of human rights: Article 12 "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks." Privacy or correspondence... "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence"