Upload files to 'content/posts/infosec'
This commit is contained in:
parent
44d599f5a2
commit
0662cab3a8
@ -0,0 +1,24 @@
|
||||
---
|
||||
title: "WikiLeaks reveals CIA tool ‘Scribbles’ for document tracking"
|
||||
date: 2017-05-08T01:35:00+06:00
|
||||
draft: false
|
||||
tags: ["surveillance","tech","data privacy","cia","wikileaks","microsoft"]
|
||||
author: "9x0rg"
|
||||
hidemeta: false
|
||||
ShowReadingTime: true
|
||||
ShowPostNavLinks: true
|
||||
showtoc: false
|
||||
cover:
|
||||
image: "<image path/url>"
|
||||
alt: "<alt text>"
|
||||
caption: "<text>"
|
||||
relative: false # To use relative path for cover image, used in hugo Page-bundles
|
||||
|
||||
---
|
||||
> The CIA is planting web beacons inside Microsoft Word documents to track whistleblowers, journalists and informants, according to WikiLeaks.
|
||||
>
|
||||
> WikiLeaks released details on what it said is a Central Intelligence Agency document tracking program called Scribbles, part of the agency’s effort to keep tabs on documents leaked to whistleblowers and journalists. Scribbles allegedly embeds a web beacon-style tag into watermarks located on Microsoft Word documents that can report document analytics back to the CIA.
|
||||
>
|
||||
> WikiLeaks [released information Friday](https://wikileaks.org/vault7/#Scribbles) about Scribbles as part of its ongoing [Vault 7 Dark Matter](https://wikileaks.org/vault7/darkmatter/releases/) release that began [last month](https://threatpost.com/wikileaks-dump-shows-cia-interdiction-of-iphone-supply-chain/124540/). Also released is what WikiLeaks said is Scribbles’ source code.
|
||||
>
|
||||
> -- Tom Spring in [ThreatPost](https://threatpost.com/wikileaks-reveals-cia-tool-scribbles-for-document-tracking/125299/) - April 28, 2017
|
||||
@ -0,0 +1,26 @@
|
||||
---
|
||||
title: "Corporate surveillance in everyday life"
|
||||
date: 2017-06-14T01:18:00+06:00
|
||||
draft: false
|
||||
tags: ["surveillance","data privacy","tech"]
|
||||
author: "9x0rg"
|
||||
hidemeta: false
|
||||
ShowReadingTime: true
|
||||
ShowPostNavLinks: true
|
||||
showtoc: false
|
||||
cover:
|
||||
image: "<image path/url>"
|
||||
alt: "<alt text>"
|
||||
caption: "<text>"
|
||||
relative: false # To use relative path for cover image, used in hugo Page-bundles
|
||||
|
||||
---
|
||||
**Report**: How thousands of companies monitor, analyze, and influence the lives of billions. Who are the main players in today’s digital tracking? What can they infer from our purchases, phone calls, web searches, and Facebook likes? How do online platforms, tech companies, and data brokers collect, trade, and make use of personal data?
|
||||
|
||||
> In recent years, a wide range of companies has started to monitor, track and follow people in **virtually every aspect of their lives**. The behaviors, movements, social relationships, interests, weaknesses and most private moments of billions are now constantly recorded, evaluated and analyzed in real-time. The exploitation of personal information has become a multi-billion industry. Yet only **the tip of the iceberg** of today’s pervasive digital tracking is visible; much of it occurs in the background and remains opaque to most of us.
|
||||
>
|
||||
> This report by Cracked Labs examines the actual practices and inner workings of this personal data industry. Based on years of research and a previous 2016 report, the investigation shines light on the hidden data flows between companies. It maps the structure and scope of today’s **digital tracking and profiling ecosystems** and explores relevant technologies, platforms and devices, as well as key recent developments.
|
||||
>
|
||||
> While the full report is available as [PDF download](http://crackedlabs.org/dl/CrackedLabs_Christl_CorporateSurveillance.pdf), this web publication [presents a ten part overview](https://crackedlabs.org/en/corporate-surveillance).
|
||||
>
|
||||
> -- By [Wolfie Christl](http://twitter.com/WolfieChristl), Cracked Labs, June 2017.
|
||||
75
content/posts/infosec/ditching-whatsapp.md
Normal file
75
content/posts/infosec/ditching-whatsapp.md
Normal file
@ -0,0 +1,75 @@
|
||||
---
|
||||
title: "Ditching WhatsApp [updated]"
|
||||
date: 2018-06-14T12:54:49+01:00
|
||||
draft: false
|
||||
tags: ["infosec","encryption","whatsapp","signal app","tech","xmpp","data privacy"]
|
||||
author: "9x0rg"
|
||||
hidemeta: false
|
||||
ShowReadingTime: true
|
||||
ShowPostNavLinks: true
|
||||
showtoc: true
|
||||
|
||||
---
|
||||
|
||||
|
||||
|
||||
*[First published on September 05, 2016]*
|
||||
|
||||
I am ditching WhatsApp, following [Facebook’s decision to begin harvesting data](https://blog.whatsapp.com/looking-ahead-for-whats-app) from its messaging service.
|
||||
|
||||
Even though *Motherboard* claims "it may be possible to [prevent WhatsApp to give your phone number to Facebook"](https://motherboard.vice.com/read/whatsapp-facebook-phone-number-how-to) (LOL) WhatsApp will still harvest your metadata.
|
||||
|
||||
|
||||
> “Sharing metadata with Facebook still exposes users to significant risks,” says Claire Gartland, consumer protection counsel for the Electronic Privacy Information Center. “Facebook will have data indicating who WhatsApp users communicate with and how frequently, and connecting WhatsApp users with their social media accounts and broader online activity, associations, political affiliations, and more.” -- [Wired](https://www.wired.com/2016/08/whatsapp-privacy-facebook/)
|
||||
|
||||
# What’s In The Metadata?
|
||||
|
||||
According to The Grugq in [Signals, Intelligence](https://medium.com/@thegrugq/signal-intelligence-free-for-all-5993c2f72f90) which takes the example of metadata carried by Signal, one of the *least privacy offender*, metadata does carry a freaking lot of actionable intelligence data; see for yourself:
|
||||
|
||||
1. **Location data**
|
||||
- Specific location (home, place of work, etc.)
|
||||
- Mobility pattern (from home, via commuter route, to work) — very unique, just [4 locations is enough to identify 90%](http://www.nature.com/articles/srep01376?ial=1) of people
|
||||
- Paired mobility pattern with a known device (known as “mirroring”, when two or more devices travel together; including car telemetry!)
|
||||
|
||||
2. **Network data**
|
||||
- Numbers dialed (who you call)
|
||||
- Calls received (who calls you)
|
||||
- Calling pattern (numbers dialed, for how long, how frequently)
|
||||
|
||||
3. **Physical data**
|
||||
- IMEI (mobile phone device ID)
|
||||
- IMSI (mobile phone telco subscriber ID)
|
||||
|
||||
4. **Content**
|
||||
|
||||
- Identifiers, e.g. names, locations
|
||||
- Voice fingerprinting
|
||||
- Keywords
|
||||
|
||||
See also [how your phone tracks your every move](https://www.abc.net.au/news/2015-08-16/metadata-retention-privacy-phone-will-ockenden/6694152) and [metadata - 6 Articles That Show How Your Metadata Knows Everything About You](https://medium.com/@blackVPN/metadata-25c3ab6d1e1d).
|
||||
|
||||
# Alternatives to WhatsApp
|
||||
|
||||
Now that I am done with WhatsApp, what alternative are available? A lot actually.
|
||||
|
||||
## Instant Messaging
|
||||
|
||||
- [Conversations.im](https://conversations.im/), a Android app developed by Daniel Gultsch based on the XMPP protocol with OMEMO[^1] and PGP encryption
|
||||
- [Signal App](https://signal.org/)
|
||||
- [Delta Chat](https://delta.chat/en/) an IM client that does not require your phone number and works on top of your own email service provider, with an option to encrypt messages with Autocrypt with your own PGP/GnuPG key
|
||||
- ~~Telegram~~ [Edit 10.06.2016] Nah, it's broken.
|
||||
|
||||
## Voice calls
|
||||
|
||||
- [Signal App](https://signal.org/)
|
||||
- [Linphone](https://f-droid.org/packages/org.linphone/) (SIP)
|
||||
- [Jitsee Meet](https://meet.jit.si/)
|
||||
|
||||
## Social Media
|
||||
|
||||
- [Twidere](https://f-droid.org/en/packages/org.mariotaku.twidere/) an Android client for Twitter and [Mastodon](https://joinmastodon.org/)
|
||||
- ~~Facebook~~ [Edit 2017: anything Facebook has been removed from my mobile device]
|
||||
|
||||
|
||||
|
||||
[1]: https://omemo.top/
|
||||
@ -0,0 +1,23 @@
|
||||
---
|
||||
title: "Google, not GCHQ, is the truly chilling spy network"
|
||||
date: 2017-06-19T12:56:00+06:00
|
||||
draft: false
|
||||
tags: ["tech","data privacy","surveillance"]
|
||||
author: "9x0rg"
|
||||
hidemeta: false
|
||||
ShowReadingTime: true
|
||||
ShowPostNavLinks: true
|
||||
showtoc: false
|
||||
cover:
|
||||
image: "<image path/url>"
|
||||
alt: "<alt text>"
|
||||
caption: "<text>"
|
||||
relative: false # To use relative path for cover image, used in hugo Page-bundles
|
||||
|
||||
---
|
||||
> Daily surveillance of the general public conducted by the search engine, along with Facebook, is far more insidious than anything our spooks get up to.
|
||||
>
|
||||
> “Surveillance”, as the [security expert Bruce Schneier has observed](https://www.schneier.com/news/archives/2014/04/surveillance_is_the.html), is the business model of the internet and that is true of both the public and private sectors.
|
||||
|
||||
-- [Guardian](https://www.theguardian.com/commentisfree/2017/jun/18/google-not-gchq--truly-chilling-spy-network) - June 18, 2017
|
||||
|
||||
28
content/posts/infosec/hacking-team-government-users.md
Normal file
28
content/posts/infosec/hacking-team-government-users.md
Normal file
@ -0,0 +1,28 @@
|
||||
---
|
||||
title: "Hacking Team government users"
|
||||
date: 2017-07-09T08:26:00+06:00
|
||||
draft: false
|
||||
tags: ["surveillance","data privacy","infosec","malaysia"]
|
||||
author: "9x0rg"
|
||||
hidemeta: false
|
||||
ShowReadingTime: true
|
||||
ShowPostNavLinks: true
|
||||
showtoc: false
|
||||
cover:
|
||||
image: ""
|
||||
alt: ""
|
||||
caption: ""
|
||||
|
||||
---
|
||||
|
||||
*The 21 suspected government users of RCS by Hacking Team*
|
||||
|
||||
> Hacking Team, also known as HT S.r.l., is a Milan-based company that describes itself as the “first to propose an offensive solution for cyber investigations".
|
||||
>
|
||||
> Their flagship Remote Control System (RCS)[^1] product, billed “the hacking suite for governmental interception,” is a suite of remote monitoring implants (i.e., spyware) sold exclusively to government agencies worldwide.
|
||||
>
|
||||
> We suspect that twenty-one governments are using Hacking Team’s RCS spyware. Except as otherwise noted, we identified these countries based on tracing endpoints of Hacking Team proxy chains: Azerbaijan, Colombia, Egypt, Ethiopia, Hungary, Italy, Kazakhstan, Korea, Malaysia, Mexico, Morocco, Nigeria, Oman, Panama, Poland, Saudi Arabia, Sudan, Thailand, Turkey, United Arab Emirates, and Uzbekistan.
|
||||
|
||||
Full report: [Mapping Hacking Team’s “Untraceable” Spyware](https://citizenlab.ca/2014/02/mapping-hacking-teams-untraceable-spyware/) by Bill Marczak, Claudio Guarnieri, Morgan Marquis-Boire, and John Scott-Railton, February 17, 2014
|
||||
|
||||
[^1]: Remote Control System (RCS) is sophisticated computer spyware marketed and sold exclusively to governments by Milan-based Hacking Team
|
||||
Loading…
Reference in New Issue
Block a user