From 0662cab3a84b3ac30062d50bb36774604f255fbd Mon Sep 17 00:00:00 2001 From: Olivier Falcoz Date: Sun, 1 Jan 2023 21:31:05 +0100 Subject: [PATCH] Upload files to 'content/posts/infosec' --- ...nting-web-beacons-inside-microsoft-word.md | 24 ++++++ ...corporate-surveillance-in-everyday-life.md | 26 +++++++ content/posts/infosec/ditching-whatsapp.md | 75 +++++++++++++++++++ ...-gchq-is-the-truly-chilling-spy-network.md | 23 ++++++ .../infosec/hacking-team-government-users.md | 28 +++++++ 5 files changed, 176 insertions(+) create mode 100644 content/posts/infosec/cia-is-planting-web-beacons-inside-microsoft-word.md create mode 100644 content/posts/infosec/corporate-surveillance-in-everyday-life.md create mode 100644 content/posts/infosec/ditching-whatsapp.md create mode 100644 content/posts/infosec/google-not-gchq-is-the-truly-chilling-spy-network.md create mode 100644 content/posts/infosec/hacking-team-government-users.md diff --git a/content/posts/infosec/cia-is-planting-web-beacons-inside-microsoft-word.md b/content/posts/infosec/cia-is-planting-web-beacons-inside-microsoft-word.md new file mode 100644 index 0000000..5bbd27a --- /dev/null +++ b/content/posts/infosec/cia-is-planting-web-beacons-inside-microsoft-word.md @@ -0,0 +1,24 @@ +--- +title: "WikiLeaks reveals CIA tool ‘Scribbles’ for document tracking" +date: 2017-05-08T01:35:00+06:00 +draft: false +tags: ["surveillance","tech","data privacy","cia","wikileaks","microsoft"] +author: "9x0rg" +hidemeta: false +ShowReadingTime: true +ShowPostNavLinks: true +showtoc: false +cover: + image: "" + alt: "" + caption: "" + relative: false # To use relative path for cover image, used in hugo Page-bundles + +--- +> The CIA is planting web beacons inside Microsoft Word documents to track whistleblowers, journalists and informants, according to WikiLeaks. +> +> WikiLeaks released details on what it said is a Central Intelligence Agency document tracking program called Scribbles, part of the agency’s effort to keep tabs on documents leaked to whistleblowers and journalists. Scribbles allegedly embeds a web beacon-style tag into watermarks located on Microsoft Word documents that can report document analytics back to the CIA. +> +> WikiLeaks [released information Friday](https://wikileaks.org/vault7/#Scribbles) about Scribbles as part of its ongoing [Vault 7 Dark Matter](https://wikileaks.org/vault7/darkmatter/releases/) release that began [last month](https://threatpost.com/wikileaks-dump-shows-cia-interdiction-of-iphone-supply-chain/124540/). Also released is what WikiLeaks said is Scribbles’ source code. +> +> -- Tom Spring in [ThreatPost](https://threatpost.com/wikileaks-reveals-cia-tool-scribbles-for-document-tracking/125299/) - April 28, 2017 \ No newline at end of file diff --git a/content/posts/infosec/corporate-surveillance-in-everyday-life.md b/content/posts/infosec/corporate-surveillance-in-everyday-life.md new file mode 100644 index 0000000..8012f8c --- /dev/null +++ b/content/posts/infosec/corporate-surveillance-in-everyday-life.md @@ -0,0 +1,26 @@ +--- +title: "Corporate surveillance in everyday life" +date: 2017-06-14T01:18:00+06:00 +draft: false +tags: ["surveillance","data privacy","tech"] +author: "9x0rg" +hidemeta: false +ShowReadingTime: true +ShowPostNavLinks: true +showtoc: false +cover: + image: "" + alt: "" + caption: "" + relative: false # To use relative path for cover image, used in hugo Page-bundles + +--- +**Report**: How thousands of companies monitor, analyze, and influence the lives of billions. Who are the main players in today’s digital tracking? What can they infer from our purchases, phone calls, web searches, and Facebook likes? How do online platforms, tech companies, and data brokers collect, trade, and make use of personal data? + +> In recent years, a wide range of companies has started to monitor, track and follow people in **virtually every aspect of their lives**. The behaviors, movements, social relationships, interests, weaknesses and most private moments of billions are now constantly recorded, evaluated and analyzed in real-time. The exploitation of personal information has become a multi-billion industry. Yet only **the tip of the iceberg** of today’s pervasive digital tracking is visible; much of it occurs in the background and remains opaque to most of us. +> +> This report by Cracked Labs examines the actual practices and inner workings of this personal data industry. Based on years of research and a previous 2016 report, the investigation shines light on the hidden data flows between companies. It maps the structure and scope of today’s **digital tracking and profiling ecosystems** and explores relevant technologies, platforms and devices, as well as key recent developments. +> +> While the full report is available as [PDF download](http://crackedlabs.org/dl/CrackedLabs_Christl_CorporateSurveillance.pdf), this web publication [presents a ten part overview](https://crackedlabs.org/en/corporate-surveillance). +> +> -- By [Wolfie Christl](http://twitter.com/WolfieChristl), Cracked Labs, June 2017. diff --git a/content/posts/infosec/ditching-whatsapp.md b/content/posts/infosec/ditching-whatsapp.md new file mode 100644 index 0000000..0d2a3e0 --- /dev/null +++ b/content/posts/infosec/ditching-whatsapp.md @@ -0,0 +1,75 @@ +--- +title: "Ditching WhatsApp [updated]" +date: 2018-06-14T12:54:49+01:00 +draft: false +tags: ["infosec","encryption","whatsapp","signal app","tech","xmpp","data privacy"] +author: "9x0rg" +hidemeta: false +ShowReadingTime: true +ShowPostNavLinks: true +showtoc: true + +--- + +![WhatsApp is broken](/images/whatsapp-is-broken.jpg#center) + +*[First published on September 05, 2016]* + +I am ditching WhatsApp, following [Facebook’s decision to begin harvesting data](https://blog.whatsapp.com/looking-ahead-for-whats-app) from its messaging service. + +Even though *Motherboard* claims "it may be possible to [prevent WhatsApp to give your phone number to Facebook"](https://motherboard.vice.com/read/whatsapp-facebook-phone-number-how-to) (LOL) WhatsApp will still harvest your metadata. + + +> “Sharing metadata with Facebook still exposes users to significant risks,” says Claire Gartland, consumer protection counsel for the Electronic Privacy Information Center. “Facebook will have data indicating who WhatsApp users communicate with and how frequently, and connecting WhatsApp users with their social media accounts and broader online activity, associations, political affiliations, and more.” -- [Wired](https://www.wired.com/2016/08/whatsapp-privacy-facebook/) + +# What’s In The Metadata? + +According to The Grugq in [Signals, Intelligence](https://medium.com/@thegrugq/signal-intelligence-free-for-all-5993c2f72f90) which takes the example of metadata carried by Signal, one of the *least privacy offender*, metadata does carry a freaking lot of actionable intelligence data; see for yourself: + +1. **Location data** + - Specific location (home, place of work, etc.) + - Mobility pattern (from home, via commuter route, to work) — very unique, just [4 locations is enough to identify 90%](http://www.nature.com/articles/srep01376?ial=1) of people + - Paired mobility pattern with a known device (known as “mirroring”, when two or more devices travel together; including car telemetry!) + +2. **Network data** + - Numbers dialed (who you call) + - Calls received (who calls you) + - Calling pattern (numbers dialed, for how long, how frequently) + +3. **Physical data** + - IMEI (mobile phone device ID) + - IMSI (mobile phone telco subscriber ID) + +4. **Content** + + - Identifiers, e.g. names, locations + - Voice fingerprinting + - Keywords + +See also [how your phone tracks your every move](https://www.abc.net.au/news/2015-08-16/metadata-retention-privacy-phone-will-ockenden/6694152) and [metadata - 6 Articles That Show How Your Metadata Knows Everything About You](https://medium.com/@blackVPN/metadata-25c3ab6d1e1d). + +# Alternatives to WhatsApp + +Now that I am done with WhatsApp, what alternative are available? A lot actually. + +## Instant Messaging + +- [Conversations.im](https://conversations.im/), a Android app developed by Daniel Gultsch based on the XMPP protocol with OMEMO[^1] and PGP encryption +- [Signal App](https://signal.org/) +- [Delta Chat](https://delta.chat/en/) an IM client that does not require your phone number and works on top of your own email service provider, with an option to encrypt messages with Autocrypt with your own PGP/GnuPG key +- ~~Telegram~~ [Edit 10.06.2016] Nah, it's broken. + +## Voice calls + +- [Signal App](https://signal.org/) +- [Linphone](https://f-droid.org/packages/org.linphone/) (SIP) +- [Jitsee Meet](https://meet.jit.si/) + +## Social Media + +- [Twidere](https://f-droid.org/en/packages/org.mariotaku.twidere/) an Android client for Twitter and [Mastodon](https://joinmastodon.org/) +- ~~Facebook~~ [Edit 2017: anything Facebook has been removed from my mobile device] + + + +[1]: https://omemo.top/ diff --git a/content/posts/infosec/google-not-gchq-is-the-truly-chilling-spy-network.md b/content/posts/infosec/google-not-gchq-is-the-truly-chilling-spy-network.md new file mode 100644 index 0000000..48e0a50 --- /dev/null +++ b/content/posts/infosec/google-not-gchq-is-the-truly-chilling-spy-network.md @@ -0,0 +1,23 @@ +--- +title: "Google, not GCHQ, is the truly chilling spy network" +date: 2017-06-19T12:56:00+06:00 +draft: false +tags: ["tech","data privacy","surveillance"] +author: "9x0rg" +hidemeta: false +ShowReadingTime: true +ShowPostNavLinks: true +showtoc: false +cover: + image: "" + alt: "" + caption: "" + relative: false # To use relative path for cover image, used in hugo Page-bundles + +--- +> Daily surveillance of the general public conducted by the search engine, along with Facebook, is far more insidious than anything our spooks get up to. +> +> “Surveillance”, as the [security expert Bruce Schneier has observed](https://www.schneier.com/news/archives/2014/04/surveillance_is_the.html), is the business model of the internet and that is true of both the public and private sectors. + +-- [Guardian](https://www.theguardian.com/commentisfree/2017/jun/18/google-not-gchq--truly-chilling-spy-network) - June 18, 2017 + diff --git a/content/posts/infosec/hacking-team-government-users.md b/content/posts/infosec/hacking-team-government-users.md new file mode 100644 index 0000000..43a00cd --- /dev/null +++ b/content/posts/infosec/hacking-team-government-users.md @@ -0,0 +1,28 @@ +--- +title: "Hacking Team government users" +date: 2017-07-09T08:26:00+06:00 +draft: false +tags: ["surveillance","data privacy","infosec","malaysia"] +author: "9x0rg" +hidemeta: false +ShowReadingTime: true +ShowPostNavLinks: true +showtoc: false +cover: + image: "" + alt: "" + caption: "" + +--- +![21 Suspected Government Users of RCS by Hacking Team](/images/hacking-team-government-users-2014.jpg) +*The 21 suspected government users of RCS by Hacking Team* + +> Hacking Team, also known as HT S.r.l., is a Milan-based company that describes itself as the “first to propose an offensive solution for cyber investigations". +> +> Their flagship Remote Control System (RCS)[^1] product, billed “the hacking suite for governmental interception,” is a suite of remote monitoring implants (i.e., spyware) sold exclusively to government agencies worldwide. +> +> We suspect that twenty-one governments are using Hacking Team’s RCS spyware. Except as otherwise noted, we identified these countries based on tracing endpoints of Hacking Team proxy chains: Azerbaijan, Colombia, Egypt, Ethiopia, Hungary, Italy, Kazakhstan, Korea, Malaysia, Mexico, Morocco, Nigeria, Oman, Panama, Poland, Saudi Arabia, Sudan, Thailand, Turkey, United Arab Emirates, and Uzbekistan. + +Full report: [Mapping Hacking Team’s “Untraceable” Spyware](https://citizenlab.ca/2014/02/mapping-hacking-teams-untraceable-spyware/) by Bill Marczak, Claudio Guarnieri, Morgan Marquis-Boire, and John Scott-Railton, February 17, 2014 + +[^1]: Remote Control System (RCS) is sophisticated computer spyware marketed and sold exclusively to governments by Milan-based Hacking Team \ No newline at end of file