RFID keys can be cloned

The Secvest alarm system from Abus can be conveniently activated and deactivated using an RFID key. But the keys can be copied within seconds. A solution to the security problem is not in sight.

Vulnerability Details:

SySS GmbH found out that the RFID technology used by the ABUS Secvest
wireless alarm system and its ABUS proximity keys (MIFARE Classic RFID
tags) is vulnerable to RFID cloning attacks.

The information stored on the used proximity keys can be read easily in
a very short time from distances up to 1 meter, depending on the used
RFID reader. A working cloned RFID token is ready for use within a
couple of seconds using freely available tools.

Thus, an attacker with one-time access to the information of an ABUS
proximity key for an ABUS Secvest wireless alarm system is able to
create a rogue RFID token that can be used to deactivate the alarm
system in an unauthorized manner.

PoC:
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-005.txt

Video:
https://t.me/BlackBox_Archiv/344

#ABUS #Alarmsystem #RFID #cloned #security #risk #poc
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

📺 ABUS Secvest Proximity Key Cloning PoC Attack Proof of Concept (PoC)
https://youtu.be/sPyXTQXTEcQ

#ABUS #Alarmsystem #RFID #cloned #security #risk #poc #video
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

🇪🇸 La mitad de los compradores de Amazon prefiere ceder sus datos a Bezos que al Gobierno

Una encuesta revela que el envío rápido es el principal motivo de los clientes para suscribirse al servicio Prime.

Si los usuarios de Amazon tuvieran que elegir a quién confiar sus datos personales, un 55,5% elegiría a Jeff Bezos. Un 48,1% los confiaría a su lugar de trabajo, un 25% al Gobierno y solo un 9,3% a Facebook. Estos datos han sido extraídos de una encuesta con varias opciones de respuesta realizada por Investing.com a más de 1.000 compradores de Amazon en Estados Unidos.

Otra muestra de la confianza que los usuarios de Amazon tienen en la tecnológica es el servicio de Amazon Key, que permite la entrega de paquetes a domicilio aunque no haya nadie en casa, puesto en marcha en Estados Unidos. Desde Investing.com señalan que “ese nivel de confianza es difícil de conseguir y muy apreciado en el sector minorista en general”.

Los resultados de la encuesta revelan que la generación milenial es la que en mayor medida opta por el servicio Prime. Y es que el envío rápido es lo que más valora el 73% de los encuestados, seguido por un 48,2% que elige esta modalidad por el servicio de televisión que ofrece el marketplace.

Desde el punto de vista de la retención de clientes, los beneficios de ser Prime pueden fomentar la fidelidad de los compradores, según el informe. Más del 80% de los usuarios estuvieron subscritos al servicio durante al menos un año y más de un tercio (37%) son miembros Prime desde hace cuatro años o más.

Cambios en los hábitos de consumo

El comercio electrónico ha pasado factura a las grandes superficies comerciales. En España, hasta el mes de abril, los centros comerciales han perdido un 5% de visitantes. Esta tendencia está llevando a que las grandes superficies busquen convertirse en centros de experiencias más allá de las compras.

Los usuarios de Amazon contribuyen a este déficit de visitantes. Según la encuesta, el 43% ha dejado de comprar en centros comerciales. Además, casi uno de cada tres compradores aseguran realizar pedidos en Amazon, al menos, una vez al mes.

El gasto mensual está en los 120 dólares y, aunque el surtido de productos en Amazon cada vez es más amplio, los libros siguen siendo su producto estrella. El 49% de los encuestados “buscaron libros y audiolibros a través de la web de venta minorista, y el 48% hizo lo mismo para sus compras de electrónica”.

Desde Investing.com señalan que “como resultado de unos precios extremadamente competitivos y de su relación con las pequeñas editoriales independientes, algunos analistas han llegado a decir que Amazon ha creado un monopolio de la industria del libro”.

Los compradores se sienten también menos inclinados a buscar en otros sitios películas, música y juegos (37%), productos de belleza y salud (30%) y ropa, zapatos y joyas (26%).

Crecimiento continuo

La mayoría de los compradores no cree que Amazon haya tocado techo tampoco. El 88% de los encuestados cree que seguirá creciendo, diversificándose hacia otras industrias. Uno de cada 4 compradores prevé que la empresa irrumpirá a continuación en el sector de los servicios de reparto, seguido del de los productos farmacéuticos (19%), la inteligencia artificial (13%) y la salud (9%).

Los inversores coinciden en que Amazon va a seguir creciendo. Las acciones de la compañía crecen alrededor de un 30% desde principios de año. El primer trimestre de 2019 supuso unos ingresos por encima de los 59.700 millones de dólares para este gigante del comercio electrónico
https://www.elespanol.com/economia/empresas/20190505/mitad-compradores-amazon-prefiere-ceder-bezos-gobierno/394711521_0.html

#amazon #privacidad
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

📺 Wir verändern gerade die Debatte
Mein Grundeinkommen bei Anne Will

Anlass der Anne-Will-Sendung waren die zunächst vollmundigen Versprechen der SPD, Hartz IV überwinden zu wollen. Dazu kamen aus der Partei zwei halbgare Vorschläge, die zwar das Wort Grundeinkommen benutzen, aber nicht im Geringsten etwas damit zu tun haben. Konkreter wurde der Vorschlag von Grünen-Chef Robert Habeck. Seine Garantiesicherung kommt unserer Meinung nach einem Grundeinkommen noch am nächsten.

📺 https://www.mein-grundeinkommen.de/news/unser-auftritt-bei-anne-will
https://www.youtube.com/watch?v=bLcPOjv2KFE

#Grundeinkommen #Video #Podcast
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

Secure WLAN

The wireless connection to the Internet, WLAN, is a practical thing. But due to software errors, comfort functions and carelessly configured routers, the home WLAN can quickly become a gateway for attackers. With simple tips, however, you can protect yourself against it - and that is highly recommended. Because if an intruder commits a crime via your WLAN (e.g. copyright infringement), you are liable as the subscriber. The following five measures help to protect your WLAN more effectively from uninvited guests:

✅ Long WPA/WPA2 password:
Use a password manager like KeePassXC or the Diceware method (6 words or more) to generate a password or passphrase with at least 32 characters. Due to the length of the password alone, an attacker is faced with an almost unsolvable task when trying to crack your password using a brute force attack. Note: The encryption is only as good as the password used.

✅ Social-Engineering:
Ideally you only use WLANs that you have set up personally or that you trust. If a WLAN with the same SSID name as your WLAN suddenly appears in the list of available WLANs, you should become suspicious and not log in or reveal any passwords. If your WLAN connection breaks down several times abruptly, it is most likely an Evil Twin attack.

✅ Deactivation of comfort functions:
You should generally disable the Wi-Fi Protected Setup (WPS) comfort function. Due to various implementation errors, WPS is always the target of attacks such as Pixie-Dust. Furthermore it is advisable to deactivate functions like "remote access" and similar completely. This considerably reduces the attack area of your WLAN.

✅ Get security updates:
Regularly checks whether (security) updates are available for your access point or router and imports them promptly.

✅ Reduce transmission power / switch off:
Wireless networks often radiate their signal far beyond the actually necessary transmission or reception range. The stronger the WLAN signal, the easier it is to carry out some of the attacks. Many router manufacturers offer the possibility to reduce the transmission power. First selects the lowest transmission power and then checks whether all devices in the desired radius can still establish a connection. It is generally advisable to deactivate the WLAN completely overnight using the schedule or night switch function.

You should not allow foreign devices that you do not control to access your WLAN. If you still wish to offer guest access, you should disconnect it from the protected or private WLAN:

✅ Separate router:
Uses a second router or access point that allows guests to log into a separate guest WLAN. Ideally, you should join a free radio initiative and allow guests or other people free access to the Internet - then you are also exempt from interference liability.

✅ Guest access:
Some routers, such as the Fritz!Box, offer guest access and allow guests to access the Internet via an additional wireless network. Thus the guest devices are (logically) completely separated from the home network or your devices.

Source and more Info:
https://www.kuketz-blog.de/empfehlungsecke/#wifi-absichern

#WIFI #setup #Secure #guide #kuketz
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

📺 It’s Time to Break Up Facebook
A founder of Facebook says it should be broken up.

📺 https://www.nytimes.com/2019/05/09/opinion/sunday/chris-hughes-facebook-zuckerberg.html
#DeleteFacebook #video #podcast

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

The cost of music

Albums and single songs can be enjoyed today mainly via streaming. But what effects does this have on the climate?

Thanks to the Internet, nobody has to deal with physical data carriers anymore. Whether it's a book (replaced by e-books), a CD (replaced by downloads and streaming) or a film (ditto): almost any content you want can go directly to our PCs, smartphones or tablets. Since it is no longer necessary to drive media through the area with trucks, and since pressing plants and printing plants with their complex (and energy-guzzling) infrastructure can be eliminated, one should actually assume that this is good for the climate and saves CO2.

Music has become cheaper
But this is not always the case. Researchers at the University of Glasgow have now pointed this out by looking at the environmental impact of the increasingly popular streaming offers for music. The team led by musicologist Matt Brennan, who collaborated with colleagues at the University of Oslo, conducted a study entitled "The Cost of Music" on the economic impact of modern music distribution. The researchers have agreed that music has become much cheaper since it is available free of charge on a subscription basis.

But this is not particularly ecological. Kyle Devine, junior professor of music in the Norwegian capital, believes that the decline of CDs and records has reduced plastic waste from the music industry. "From the perspective of CO2 emissions, however, the switch to streaming to Internet-connected devices has led to significantly higher emissions. He relates this assessment to the entire history of music.

Servers eat electricity
The reason for this is the infrastructure required for streaming - starting with the servers of the music companies, the network operators and all the way to the end customer device. Brennan & Co. have calculated that the storage and processing of digital music consumes "enormous power and energy resources". For this purpose, they converted the plastic production required for the production of sound carriers into climate gas units and compared it with the streaming requirements. The result: CO2 emissions are significantly higher than in the past - even compared to the boom phases of vinyl and CD sales.

Of course, it depends a lot on how the infrastructure is operated. Not every streaming provider is an environmental sinner. Apple, for example, points out that all its data centers run on renewable energy. However, the company also uses service providers such as Amazon Web Services or Microsoft Azure because its own capacities are not sufficient. What is particularly clear is that streaming, even if it does not look like it due to its immaterial appearance, has a climate effect that cannot be neglected. There's only one thing that helps here: once again pick up the old-fashioned CD, which has probably been in the house for years and has long since earned its climate budget.

PDF🇬🇧:
https://www.gla.ac.uk/media/media_643298_en.pdf

Source🇩🇪:
https://www.heise.de/tr/artikel/Die-Kosten-der-Musik-4404091.html

#Thinkabout #music #climate #pdf
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

The voice of journalism
Columbia Journalism Review - Facebook?

With all that has transpired between Facebook and the media industry over the past couple of years—the repeated algorithm changes, the head fakes about switching to video, the siphoning off of a significant chunk of the industry’s advertising revenue—most publishers approach the giant social network with skepticism, if not outright hostility. And yet, the vast majority of them continue to partner with Facebook, to distribute their content on its platform, and even accept funding and resources from it.

Given that Facebook has not only helped hollow out newsrooms across the country but arguably lowered the overall quality of civic discussion, repeatedly flouted laws around privacy in ways that have served the needs of foreign actors like the Russian government, and played a key role in fomenting violence in countries like Myanmar and India, it’s worth asking: Is it enough to be skeptical? Or is there an ethical case to be made that media companies, and the journalists who work for them, should sever their ties to Facebook completely?

The argument in favor of staying on Facebook is obvious: the social network has immense reach—2 billion monthly active users—, which provides publishers with the potential to increase their readership. Facebook also has billions of dollars to spread around, whether it’s through advertising revenue sharing, or by funding journalism initiatives, to which it recently committed a total of $300 million over the next three years. Together, Facebook, Twitter, and Google have become the biggest journalism funders in the world, a sad irony given their effects on the business.

Traffic from Facebook has been declining for many publishers, as the social network tweaks its algorithm to focus more on personal sharing. But even so, Facebook continues to drive a lot of revenue. So if you’re a publisher and you want to stay in business, you really have no choice but to work with it. The only other option is to continue to publish to a smaller and smaller group of readers, bringing in smaller amounts of ad revenue every year. Many media outlets have done the math, and decided they have no other option but to play ball—even if means playing ball with a company that not only owns the ball, but also the stadium, and all the uniforms, and the broadcast rights for all the games.

Some take the case even further. At a recent journalism conference in Perugia, City University of New York journalism professor Jeff Jarvis moderated a panel entitled “Criticize Facebook? Sure. Leave? Why?” Jarvis has argued that media companies shouldn’t just passively use Facebook, but should take advantage of the company’s knowledge about how social networks function to learn how to serve their audiences better. (The News Integrity Initiative, which Jarvis helped create, receives funding from Facebook, but he says this doesn’t affect his views about the company).

The panel featured Jesper Doub, a former Der Spiegel journalist who is now Facebook’s director of news partnerships for the EMEA region, Jennifer Brandel of Hearken, former Guardian editor-in-chief Alan Rusbridger, and James Ball, a UK journalist. While many on the panel (apart from Doub) were skeptical of Facebook’s relationship with the media, most seemed to agree with Ball that, despite a multitude of sins, media companies still needed to be on the platform because “that’s where the people are.” Individuals might want to quit the social network, Ball said, but media companies would be stupid to do the same.

Read more:
https://www.cjr.org/the_new_gatekeepers/should-the-media-quit-facebook.php

#DeleteFacebook #journalism #news #publishers #why
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

📺 Citizen Scoring in the EU - it happens at home, not only in China!
re:publica

Several EU governments use automated decision-making systems to score citizens, either to spot welfare fraud, detect whether children are in danger of neglect, or determine how much care elderly or disabled persons should get. AlgorithmWatch's research shows that these systems are deployed much more widely than commonly known in many countries in Europe, and that they lack oversight and accountability.

📺 https://www.youtube.com/watch?v=HVkumdj-97s
#scoring #EU #China #why #video #podcast

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

🎧 Steganography enables sophisticated OceanLotus payloads.

Researchers at Blackberry Cylance have been tracking payload obfuscation techniques employed by OceanLotus (APT32), specifically steganography used to hide code within seemingly benign image files. Tom Bonner is director of threat research at Blackberry Cylance, and he joins us to share their findings.

📻 #ResearchSaturday #Steganography #OceanLotus #payloads #podcast
https://www.thecyberwire.com/podcasts/cw-podcasts-rs-2019-05-11.html

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

Product placement
Did you get the advertising message?

From "House of Cards" to "Stranger Things": Streaming services like Netflix and Amazon manipulate their audience with advertising - almost unnoticed.

Every viewer of the Netflix horror series Stranger Things knows that the favourite food of the mysterious main character Eleven is Eggo's ready-made wafers. Not only because the girl constantly feeds the waffles, the waffles also play a leading role in several scenes and already at the end of the first season give the viewer an indication of Eleven's serial fate. Even in the mobile phone game for the series you have to collect the waffles, and the viewer is also unusually well informed about the culinary preferences of other characters: The high school boy Steve Harrington loves Fast Food by Kentucky Fried Chicken, as he reveals in the first episode of the second season. An entire scene is set up around a table full of clearly visible cups and cardboard buckets from the restaurant chain. "I love KFC," says Steve Harrington and then even says the official advertising slogan in the English language: "It's finger lickin' good."

Streaming services like Netflix or Amazon Prime Video don't show advertising blocks like linear television, but they're still not free of advertising. A large part of the own productions of the streaming services as well as the purchased contents contain product placements. At Netflix it is said to be about three quarters, at Amazon almost all.

Even in the science fiction series "The Expanse", whose told world has little to do with the present, a few Fedex containers were accommodated. Often the clothes of the characters look conspicuously like the collection of a fashion discounter. Currently, fans of the fantasy series "Game of Thrones" are discussing whether a Starbuck's coffee mug that has accidentally been left on the set could be surreptitious advertising. And Frank Underwood from the Netflix series "House of Cards" regularly played real-life computer games and talked to other characters about them when he wasn't training with his Waterrower, a rowing machine with a real water tank. Allegedly, the sales figures of the training device rose steeply at the start of every new season of the series.

Currently fans of "Game of Thrones" are discussing a Starbuck's coffee mug
Product placement is a billion market. Also because the important target group of under 50s with above-average incomes is difficult to reach via linear television. They often have subscriptions to streaming services and no TV at all. This is why there are now agencies such as Saint Elmo's that specialise in placing products in digital entertainment formats. The company's website says: "Your advertising messages don't reach the target group? Stop advertising - start with content marketing! Your advertising is more effective if it is not perceived as such. But as exciting, useful, contemporary content. Then it also works with the target group." This often works very well - the serial producers have little inhibitions to use real existing waffles as plotter elements or an advertising slogan as punchline.

There could only be problems with German law. For streaming services, the State Broadcasting Treaty is applied here, according to which product placements are permitted, but must be marked at the beginning of the programme. Illegal surreptitious advertising occurs when the product placement is not marked or "if it takes place in return for payment or similar consideration". So are Elevens Eggos and Steve Harrington's chicken legs surreptitious advertising? Netflix has included a reference to product placement before many of its formats as required in the broadcasting contract.

In the new directives for audiovisual media adopted by the European Parliament in 2018 but not yet implemented, the existing provisions on the handling of advertising were extended to streaming services. Children in particular should then be better protected from advertising. According to the new directives, product placements are still permitted if they are labelled accordingly and the product is not highlighted.

Until the Directives have been converted into national law, the Interstate Broadcasting Treaty, which has already been applied in one case, will apply: Earlier this year, the Bavarian Regulatory Authority for New Media (BLM) prohibited Amazon Prime Video from providing an episode of the eighth season of "Pastewka" on suspicion of surreptitious advertising. The episode was largely set in a media market. The production company Brainpool denied a product placement, the electronics market had been rented. Media Markt also denied having booked a product placement. The case has now been resolved out of court: Amazon shows a new cut of the episode, with which BLM also agrees.

And then, of course, there's the free mobile game until the next season starts.
However, product placement and surreptitious advertising is not only a legal issue. The embedding of products and the linking of different content and media simply corresponds to the logic of such platforms for digital content. The free mobile game to "Stranger Things" is not only a nice pastime until the next season, but also expands the environment for possible advertising content and binds viewers to the digital infrastructure of companies. This is because the game is likely to be played on a device on which the Netflix app is installed. It's not far from the game to the next series marathon. For a company like Amazon, product placements in its Prime Video content offer completely different possibilities than just customer retention: The Internet department store, which Amazon still is first and foremost, is only a few clicks away.

If products can be placed in this way, would political influence on the content of streaming services not also be conceivable? Can't ideologies be integrated into fictional content in the same way, or even more subtly? This is not yet a problem for the large streaming services, as they defend themselves against overly clear political positioning in order to reach as many viewers as possible. But in social networks, political messages - often wrapped in seemingly harmless parodies or memes - in combination with scandalizing algorithms have become a big problem.

There are websites like Infowars that have recognized these possibilities in digital space at an early stage and sell the right survival equipment for their lurid catastrophe news. The product placements show the power of manipulation inherent in digital media. The paragraphs of the Interstate Broadcasting Treaty alone are not enough to get a grip on this.

https://www.sueddeutsche.de/medien/netflix-amazon-streaming-product-placement-1.4441198

#netflix #amazon #DeleteAmazon #streaming #advertising #manipulation #why
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

📺 Software-Rebellen - Die Macht des Teilens

Auf dem Softwaremarkt stehen sich zwei Modelle gegenüber: die sogenannte proprietäre Software der großen Unternehmen und die freie Software, die allen Bürgern kostenlos zur Verfügung steht. Die Doku zeigt anhand von Beispielen aus Indien, den USA und Europa, wie anonyme Entwickler und bekannte Persönlichkeiten versuchen, einer neuen Art des Wissenskapitalismus entgegenzuwirken.

📺 #Software #Rebellen Die Macht des Teilens #Doku #ArteF #Video #Podcast

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES

F-Droid: Free and Open Source Apps - Take back control! (Part 5)

1. app store with class

By installing LineageOS, we have abandoned our proprietary Android systems and taken control of outbound data traffic with AFWall+. But our journey is far from over, because to get rid of Google and to regain control we have to break away from the Google Play Store.

Most apps from the Google Play Store contain an above-average number of tracker and advertising modules. In the foreseeable future, this business model will probably not change because Android is a self-service data store with which (questionable) developers make a lot of money. Indirectly, Google also earns a lot of money - so Android users can wait in vain for an improvement.

In this article I would like to introduce you to the alternatives App-Store F-Droid. F-Droid is a consumer-friendly alternative to Google's Play Store, which only offers "free" and "open source" apps for download. The two properties "free" and "open source" mean basically nothing else than that the app source code can be viewed, used, changed and further developed by anyone. With its strict "Free Open Source Software (FOSS)" concept, F-Droid clearly sets itself apart from the Google Play Store and other comparable stores.

2. F-Droid Store

In the long run, your goal should be to replace the proprietary apps from the Google Play Store with open source apps from the F-Droid Store, which neither transmit unsolicited sensitive data nor are crammed with tracker and advertising modules. In my experience, it's far less work to resort to privacy-friendly apps from the outset than to teach data-hungry apps or services to "behave". For this reason, the main source for your apps should be the F-Droid Store, because the article series "Take back control!

2.1 The lack of transparency of data processing

In my opinion, we can only achieve the greatest possible control over our data if we or other people (except the app developer) are able to understand the functionality of the installed apps. Furthermore, by disclosing the source code, a developer shows that he does not (only) have financial interests in the foreground and also signals that he does not want to "hide" anything with regard to the program code. This openness is an essential step towards more transparency of the application.

And yes, I am aware that some apps are so complex that even the openness of the developers described above does not guarantee that there are no mysterious code snippets hidden in the source code of the app, whose meaningfulness and meaning can hardly be explained. Therefore, you can never be 100% sure that the app will spy on you even with these apps. Therefore we should not blindly trust the FOSS apps.

In my opinion, however, the disclosure of the source code is a step in the right direction, because it allows someone with the appropriate resources to check the code themselves and, if necessary, adapt it to their needs. A big disadvantage of the mostly proprietary apps, which are located in the Google Play Store, is the lack of transparency of data processing. Because with these proprietary apps we don't know and often can't check what they actually do (without our knowledge).

Under references I list various security and data protection problems. More than half of the entries listed there concern proprietary apps from the Google Play Store. With this in mind, I think it's essential to get as many apps as possible from the F-Droid Store, even if we have to cut back on app selection there. I am aware that this is not always easy. But in the sense of the article series "Take back control! a desirable and necessary goal.

2.2 F-Droid Store Features

With the F-Droid Store, an alternative app store has established itself. Critical users who value free and open source applications will particularly benefit from the FOSS apps available there. The lower selection of apps in the F-Droid Store compared to the Google Play Store may seem a bit "frightening" at first glance. Apps, which you know from the Google Play Store so far, you will probably search in F-Droid in vain. In the F-Droid Store, however, you'll also find useful open source alternatives to most of Google Play's apps, which you should definitely give a chance to

Especially users, for whom data protection or the protection of secrets plays an important role, such as lawyers or doctors, should always take care for ethical reasons alone not to install (proprietary) apps, where the data processing is intransparent and thus there is always the danger that apps access information of their clients or patients, which in turn can also be associated with criminal and professional consequences.

Despite the sympathy I have for F-Droid Store, I don't want to hide the fact that this alternative app distribution channel also has a few special features and "shortcomings", which are briefly described in the following:

Use at your own risk:
In the terms of use for the F-Droid Store, the operators point out that despite all efforts they cannot completely guarantee that no malware is offered through the F-Droid Store.

However, before releasing an app, F-Droid operators check the source code of the app to be discontinued for potential security or "privacy" issues. If they don't find any problems, compile them and make the app available in the F-Droid Store. Because this procedure is not a deep or complete "code audit", the F-Droid Store should not be seen as a guarantee for a malware-free marketplace. Rather, we must always have a healthy mistrust of these apps as well. The question as to whether an app is defective or not can often only be answered by extensive and extensive long-term tests of the app.

The F-Droid operator (understandably) cannot and will not perform these tests. A first "shortcoming" of the F-Droid Store is therefore that a new app to be discontinued is generally not or cannot be fully tested. This is different, at least according to Google, e.g. at the Google Play Store. Before a new app is added to the Google Play Store, so-called bouncers automatically check it for "malware". The apps are executed in a virtual environment (similar to antivirus scanners) and screened by the main system for their behavior and functionality. This measure sounds very promising, but as the following examples illustrate, Google cannot guarantee a malware-free store:

Google Play:
Millions of camera apps steal photos (February 2019)

https://www.heise.de/security/meldung/Google-Play-Millionenfach-verbreitete-Kamera-Apps-klauen-Fotos-4295992.html

Fake app in Google's Play Store should steal crypto money (February 2019)

https://www.heise.de/newsticker/meldung/Fake-App-in-Googles-Play-Store-sollte-Kryptogeld-stehlen-4304280.html

Trojan apps discovered with 4.5 million downloads in Google Play (January 2018)

https://www.heise.de/security/meldung/Trojaner-Apps-mit-4-5-Millionen-Downloads-in-Google-Play-entdeckt-3952145.html

One million Android users download false WhatsApp messenger from Google Play (November 2017)

https://www.heise.de/security/meldung/Eine-Million-Android-Nutzer-laden-falschen-WhatsApp-Messenger-aus-Google-Play-3880190.html

Android spyware undetected in Play Store for three years (April 2014)

https://www.heise.de/security/meldung/Android-Spyware-drei-Jahre-lang-im-Play-Store-unentdeckt-3691154.html

[…]
For the F-Droid Store, however, I don't know yet that a faulty app has been found so far. A little exaggerated, one can conclude that F-Droid actually seems to be the "malware-free" store.

Delayed (security) updates:
In contrast to the Google Play Store, app developers in the F-Droid Store have practically no control / no influence over the release and update process of their app. Rather, maintainers are responsible for posting the releases and updates of the apps in the F-Droid Store. If the maintainer is negligent or "prevented" from doing so, this can result in the worst-case scenario where security holes in apps that have become known are not reacted to promptly, even though the developer has already closed them. At least for many apps we can rely on the fact that an app maintainer has not made any changes to the source code that could have a negative effect on our data or device. F-Droid supports Reproducible_Builds.

Weak spots:
Like all software, F-Droid has to struggle with bugs that can lead to security vulnerabilities. In early 2015, a security audit of the F-Droid App and the service infrastructure identified a number of security vulnerabilities, all of which were promptly addressed. Security vulnerabilities are generally unavoidable. Rather, one must simply reckon with the fact that each software has some gaps. It is therefore all the more important to deal with them professionally once any security vulnerabilities have become known. Since the F-Droid team deals professionally and openly with the vulnerabilities found, this is a good indication that the team is aware of its responsibility. Also worthy of positive mention are the continuous security audits. The last audit, for example, is dated September 2018.

Despite the above-mentioned aspects, which I regard as "shortcomings", I would like to mention a special feature or "service" of the F-Droid Store. This special feature is due to the FOSS apps included in the F-Droid Store. Due to the fact that basically everyone at FOSS-Apps is able to change the source code under certain conditions, the F-Droid team makes use of this option from time to time. It sometimes (arbitrarily) removes so-called "antifeatures" from the original app version. One of the antifeatures in apps is the F-Droid project:

✅Ads (advertising)
✅tracking
✅NonFreeNet (uses non-free services in the network)
✅NonFreeAdd (recommends non-free add-ons)
✅NonFreeDep (depends on non-free components such as Google Play Services)
✅UpstreamNonFree (missing functionalities because non-free components had to be removed)
✅NonFreeAssets (contains non-free components - mostly multimedia data under non-free license)

A prominent example in which the team of the F-Droid Store became active and removed corresponding antifeatures from the corresponding app was the Telegram Messenger. The team issued a message to this effect:

"Several proprietary parts were removed from the original Telegram client, including Google Play Services for the location services and HockeySDK for self- updates. Push notifications through Google Cloud Messaging and the automatic SMS receiving features were also removed."

The approach of the F-Droid team to do without services or functions that are not exactly conducive to "data protection" or to remove them from the source code has additionally encouraged me in my decision to choose F-Droid as the app source for the article series "Take back control!

3. starting with F-Droid

First you have to download the F-Droid Store as an APK file to your computer. Just open the F-Droid page and click on the button Download F-Droid. https://f-droid.org/FDroid.apk

Download:
First download the latest version of F-Droid directly from the website. Click on the button labeled Download F-Droid.
https://f-droid.org

PGP Signature:
Optionally you can check the PGP signature of the downloaded APK file to make sure that the file has not been corrupted or modified. First you have to import the public F-Droid-Signing-Key:

pg --keyserver pgp.mit.edu --recv-keys 0x41e7044e1dba2e89

The fingerprint can then be checked:

gpg --verify FDroid.apk.asc FDroid.apk

Is the main and sub fingerprints identical to those on the F-Droid website?

Main fingerprint = 37D2 C987 89D8 3119 4839 4E3E 41E7 044E 1DBA 2E89
Under fingerprint = 802A 9799 0161 1234 6E1F EFF4 7A02 9E54 DD5D CE7A

Installation:
If the PGP signature matches you can copy the APK file via USB cable to the device. On your device you can tap the file and start the installation. A warning will appear in Android before installing F-Droid. This mechanism should prevent you from accidentally installing apps from "unknown sources" (far away from the Google Play Store) and catching malware. The hint is confirmed with a tap on Next and the installation is completed.

3.1 F-Droid in action

After the first start of the F-Droid app no apps will be displayed. You first have to update the so-called package sources (a list of available apps with their descriptions) by wiping the screen from top to bottom with one finger. https://de.wikipedia.org/wiki/Repository

The message "Package sources are being updated" will then appear at the top of the screen. Depending on the Internet connection and the load of the F-Droid servers, the process may take one to two minutes. In order for this process to happen automatically in the future, we select the "Options" menu at the bottom of the screen. Recommended settings:

✅(Optional) Via mobile network:
slider all the way to the left (to conserve data volume)

✅Automatic update interval:
Daily

Under package sources you should additionally select F-Droid archives.

You can then browse for apps using the "Categories" menu at the bottom of the screen. The apps are arranged in different categories like internet, multimedia or navigation.

If you have found an app and want to install it, just click on the blue download arrow next to the app name to start the download. As soon as the app is on your device, the arrow turns into a button labeled Install. You will then be asked again if you really want to install the app and all permissions of an app will be listed. Even if we are not aware of any "abuse" of the permissions of an F-Droid app, you should always check the permissions before each installation.

4. app suggestions

Due to the lack of transparency of the entire data processing of a smartphone, it is extremely time-consuming to determine which data the smartphone (actually) processes or sends. The same applies, of course, to the apps used in the Google Play Store. Most of these apps are closed source as shown above and therefore do not allow (without further technical aids) an insight into the actual data processing or which data is transmitted during use.

It would be an illusion to believe that app providers always process our data for our own benefit. Rather, anyone who is familiar with the current business models of providers and manufacturers should be aware that the opposite is the case. Very often the "protagonists" exchange the data we collect with each other for commercial purposes without us noticing it, let alone preventing it. In this respect, it is essential and almost a duty for every data protection-conscious user to question for himself whether he might not want to do better without the proprietary apps.

Therefore, our goal should be to replace as many apps as possible with privacy friendly alternatives. To show what I think makes a "privacy friendly" app, I have summarized the main criteria of a privacy friendly app:


✅Ideally, the app will not communicate with the manufacturer or provider (not even for the transmission of "meaningless" telemetry data).

✅Transparency through open source code and, if applicable, corresponding, transparent data protection declaration.

✅Request the (only) necessary access permissions necessary for the app to work for its intended purpose.

✅Data economy (processing as little data as possible or only the data that is really necessary for the functionality of the app).

✅Possibilities to disagree with corresponding data processing.

✅Apps that help prevent us from having to disclose our information to anyone, e.g. by using encryption measures to ensure that providers of other apps do not use these apps to gain unsolicited access to our data.

These are, of course, high standards that I apply here. In this context, however, we should perhaps recall the stated objective of the series of articles: To regain control of our data.

4.1 Recommended Apps

At the risk that this part of the article loses its topicality too quickly, I refer to the recommendation corner. There all privacy friendly apps from the F-Droid Store will be listed and constantly updated. https://www.kuketz-blog.de/empfehlungsecke/#android

The app selection should only cover the "basics" to make it easier for you to switch to privacy friendly apps. In F-Droid there are of course many more apps and alternatives to discover. Tastes are different and not every app I recommend will please the individual. So my advice to you is to browse the F-Droid Store and find your own apps that will suit your taste best.

5. further App-Stores

If you buy a large part of your apps exclusively from the F-Droid Store, you will come much closer to the noble goal of having control over your own data on a smartphone.

Admittedly, the transition to the F-Droid Store is not easy. This is less due to the poor usability of this store than to the comparatively small range of apps. We won't find current (blockbuster) games or "trend apps", such as WhatsApp, in the F-Droid Store, because as shown, we only find free and open source apps in the F-Droid Store.

5.1 Yalp Store

The Google Play Store is usually accessed via the "Play Store" app. In F-Droid, however, we find an alternative that avoids Google dependencies and can also be interesting for users of a custom ROM if no Google Services Framework is installed. The Yalp Store app available in the F-Droid allows you to download apps (or APKs) directly from the Google Play Store. However, when using this app, we are in a grey area or an area that has not yet been conclusively clarified in legal terms. This is especially because the Yalp Store is not officially offered by Google or originated by Google, but only the Play Store API is used to access this app / service. This is basically a violation of the terms of use of the Play Store:

"You agree not to access (or attempt to access) Google Play by any means other than through the interface that is provided by Google, unless you have been specifically allowed to do so in a separate agreement with Google. You specifically agree not to access (or attempt to access) Google Play through any automated means (including use of scripts, crawlers, or similar technologies) and shall ensure that you comply with the instructions set out in any robots.txt file present on the Google Play website."

That we are in a legally highly controversial grey zone when using apps like Yalp or services like APKPure, which download the APKs from the Playstore, becomes clear when we look at an interview with a lawyer and the discussion on areamobile. Without wanting to deal intensively with all the legal implications mentioned there, it is essential, in my opinion, to take a differentiated approach in answering the question of the legality of the use of these services. The first question to be answered is which "copyrights" (by whom) are potentially violated when downloading apps from the Play Store with these services. http://www.areamobile.de/community/news/188457-darf-ich-das-android-ohne-google-apps-ohne-play-store.html

In my opinion, it plays an important role to differentiate between how and under which license conditions the apps were published. If it is "proprietary" software that is offered exclusively in the Google Play Store, an infringement of copyrights may well be obvious. However, the situation is different with FOSS apps, which have been posted in the Play Store as well as in the F-Droid Store or on the developer's website. If you download this app from the Play Store using services such as Yalp, you shouldn't violate the rights of the actual author (the app developer), who actually designed the app "openly" and "freely". Rather, the (alleged) rights of Google, which the author had to grant to Google in order to be allowed to place his apps in the Play Store, are in question.

In order not to expose yourself to this problem in the first place, it would be better to do without the apps in the Google Play Store completely and to use apps from the F-Droid Store. If this is not possible for you - for whatever reason - the Yalp Store can be an alternative to the Play Store and is interesting for all those who use custom ROMs like LineageOS, but prefer not to install the proprietary GAPPS.

5.2 Reality vs. wishful thinking

Personally, I get by completely without apps from the Google Play Store. A few years ago, this was unthinkable for many privacy-sensitive users because the number of apps in F-Droid was still relatively small. In 2019 it improved the situation a bit. Nevertheless, there are still apps that are only offered in the Play Store. It would therefore be unrealistic to simply assume that everyone can get by with the apps offered in the F-Droid.

So if you can't find an alternative in F-Droid for your "favourite app" from the Google Play Store, you won't be able to avoid getting some of your apps from the Play Store. Since the apps from the Play Store are often accompanied by a "loss of control", I will show you in further parts of the article series how you can minimize this with apps like AdAway, Shelter or XPrivacyLua.

6. conclusion

The F-Droid Store gives us access to FOSS apps, which are intended to serve as an alternative to well-known apps. As a critical user, we benefit in particular from the free and open source applications offered in the F-Droid Store. This will enable us to regain a great deal of data dominance on our smartphone.

Ideally, you can completely renounce the Google Play Store. If you don't succeed and prefer to forego the additional installation of GAPPS on your device, you'll find a possible alternative in the Yalp Store - but that's a legal grey area.

In the following article of the article series we will dedicate ourselves to the tracking and advertising blocker AdAway. AdAway is comparable to a local pi-hole that works directly on the device. For all those who continue to purchase apps on the Play Store, AdAway is an effective way to make the integrated tracker and advertising modules "harmless".

Source (german) and more info:
https://www.kuketz-blog.de/f-droid-freie-und-quelloffene-apps-take-back-control-teil5/

#android #NoGoogle #guide #part1 #part2 #part4 #part5 #fdroid #kuketz
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES