NoGoolag
4.53K subscribers
14.3K photos
7.46K videos
600 files
14.9K links
Download Telegram
The hidden trackers in your phone, explained

How covert code enables your phone’s apps to spy on you.

In the earlier days of the coronavirus pandemic, an animated map from a company called Tectonix went viral. It showed spring breakers leaving a Florida beach to return to their homes across the US, as a series of tiny orange dots congregating on a beach in early March scattered across the country over the following two weeks.

“It becomes clear just how massive the potential impact of just one single beach gathering can have in spreading this virus across our nation,” the video’s narrator said. “The data tells the stories we just can’t see.”

But there was another story there that most of us can’t see: how trackers hidden in smartphone apps are the source of incredible amounts of specific data about us, much of which gets sent to companies you’ve never heard of. This has been going on for years and is an essential part of the mobile app economy. But it took the Covid-19 pandemic to bring some of these companies, and what they’re capable of, to the forefront.

https://www.vox.com/recode/2020/7/8/21311533/sdks-tracking-data-location

#privacy
China to test sovereign digital currency on ride hailing giant Didi

BEIJING (Reuters) - China’s central bank is partnering up with Didi Chuxing to test the use of its digital currency, which could make China’s dominant ride hailing platform one of the world’s first’s corporate users of a government-created virtual currency.

The digital currency research unit of People’s Bank of China (PBOC) is working with Didi to apply digital currency electronic payment, or DCEP, on the ride hailing app, Didi said in a statement on Wednesday.

Didi said the partnership occurred in an atmosphere where “the government seeks to support the development of the real economy sectors with innovative financial services.”

https://www.reuters.com/article/us-china-crypto-didi/china-to-test-sovereign-digital-currency-on-ride-hailing-giant-didi-idUSKBN24914U

#asia #china
Facebook suspends disinformation network tied to staff of Brazil's Bolsonaro

(Reuters) - Facebook Inc (FB.O) on Wednesday suspended a network of social media accounts it said were used to spread divisive political messages online by employees of Brazilian President Jair Bolsonaro and two of his sons.

The company said that despite efforts to disguise who was behind the activity, it had found links to the staff of two Brazilian lawmakers, as well as the president and his sons, Congressman Eduardo Bolsonaro and Senator Flavio Bolsonaro.

Nathaniel Gleicher, Facebook’s head of cybersecurity policy, said the accounts were removed for using fake personas and other types of “coordinated inauthentic behaviour” which violated the company’s rules.

https://www.reuters.com/article/us-facebook-disinformation-brazil/facebook-suspends-disinformation-network-tied-to-staff-of-brazils-bolsonaro-idUSKBN2492Y5

#brazil #facebook
CEO of exam monitoring software Proctorio apologises for posting student's chat logs on Reddit

Australian students who have raised privacy concerns describe the incident involving a Canadian student as ‘freakishly disrespectful’

The chief executive of an exam monitoring software firm that has raised privacy concerns in Australia has apologised for publicly posting a student’s chat logs during an argument on the website Reddit.

Mike Olsen, who is the CEO of the US-based Proctorio, has since deleted the posts and apologised, saying that he and Proctorio “take privacy very seriously”.

Proctorio is a browser extension-based software that can monitor students through webcams as they take exams from home, and is used by the Australian National University and the University of Canberra, among others. It potentially grants access to a student’s webcam, microphone and keystrokes to detect and prevent cheating during an exam.

https://www.theguardian.com/australia-news/2020/jul/01/ceo-of-exam-monitoring-software-proctorio-apologises-for-posting-students-chat-logs-on-reddit

#australia #exam #privacy
Ministers urged to limit Facebook and Google's power over ad market

CMA proposals include requiring Google to share data and making personalised ads optional in UK

Facebook could be forced to allow users to switch off personalised advertising, and Google required to hand valuable data about search engine usage to competitors, under UK proposals to introduce competition into the digital advertising market.

The two companies accounted for 80% of all digital advertising spending in the UK last year, according to the Competition and Markets Authority (CMA), leading to fears they have developed “such unassailable market positions that rivals can no longer compete on equal terms”.

https://www.theguardian.com/media/2020/jul/01/ministers-urged-to-limit-facebook-and-google-power-over-uk-ad-market

#uk #google #facebook
Leaked documents show what it looks like when TikTok hands over a user's data to police

Like all apps, TikTok is constantly collecting information about its users. Newly leaked documents show what happens when that information is requested by police.

The documents first surfaced as part of BlueLeaks, a data dump of hundreds of thousands of sensitive police files from across the globe obtained by anonymous hackers and published by the transparency group DDoSecrets. The server that hosted BlueLeaks was taken offline by German authorities this week, but before they were removed Business Insider obtained copies of TikTok reports on specific users sent to police departments.

TikTok's practice of providing user data to police is not new, or particularly unique — all social media platforms are required by law to comply with court orders or subpoenas demanding information about users suspected of criminal activity.

https://www.businessinsider.com/tiktok-police-law-enforcement-requests-2020-7

#tiktok #privacy
AWS is Harvesting AI Customers’ Content by Default, and Storing it Outside Users’ Selected Regions

AWS is harvesting customer’s “AI content” for its own product development purposes and storing it outside the geographic regions that customers have explicitly selected.

The cloud provider’s users may need to have read through 15,000+ words of service terms to notice this fact. The default for users is an opt-in to permit this.

AWS has until recently required customers to actively raise a support ticket if they want to stop this happening (if they had noticed it was in the first place).

Less detail-oriented AWS users, who opted instead to just read 100 words of AWS’s data privacy FAQs  — “AWS gives you ownership and control over your content through simple, powerful tools that allow you to determine where your content will be stored” — may be in for something of a shock. (Always read the small print…)

https://www.cbronline.com/news/aws-user-data

#amazon #aws #privacy
‘You can’t pay cash here’: how our newly cashless society harms the most vulnerable

Retailers and banks have been pushing us to use contactless payments and online services for hygiene reasons. But many older, abused and unbanked people still depend on cash. What will happen to them?

It had taken so much for Tina to get to the supermarket; to go home empty-handed left her in tears. Tina, 47, has conditions including chronic fatigue syndrome, fibromyalgia, post-traumatic stress disorder, anxiety and depression. She should not have been out at all, but, although her doctor had told her to shield indoors, she had not been put on the government’s high-risk list, meaning she has to do her food shopping herself.

https://www.theguardian.com/money/2020/jun/24/you-cant-pay-cash-here-how-cashless-society-harms-most-vulnerable
France to introduce controversial age verification system for adult websites

Macron made the protection of children against adult content online a high-profile issue.

PARIS — The French Parliament unanimously agreed on Thursday to introduce a nationwide age verification system for pornography websites, months after President Emmanuel Macron pledged to protect children against such content.

Macron made the protection of children against adult content online a high-profile issue well before the coronavirus crisis hit. In January, tech companies, internet services providers and the adult movies industry signed a voluntary charter, pledging to roll out tools to help ensure minors don’t have access to pornographic content.

https://www.politico.eu/article/france-to-introduce-controversial-age-verification-system-for-adult-pornography-websites

#france
PimEyes - A Polish company just abolishes our anonymity

Research by
netzpolitik.org shows the potential for abuse of PimEyes, a free search engine for 900 million faces. All of whom have photos on the Internet could already be part of their database.

Dylan smiles into the camera, arm in arm with the other guests of a queer boat party. Behind them, glasses glisten on the shelves of a bar. Eight years ago a party photographer uploaded this snapshot on the internet. Dylan had already forgotten it - until today. Because with a reverse search engine for faces, everyone can find this old party photo of Dylan. All they have to do is upload his profile picture from the Xing career network, free of charge and without registration. But Dylan wants to keep his private and professional life separate: During the day he works as a banker in Frankfurt am Main.

The name of the search engine is PimEyes. It analyses masses of faces on the Internet for individual characteristics and stores the biometric data. When Dylan tests the search engine with his profile picture, it compares it with the database and delivers similar faces as a result, shows a preview picture and the domain where the picture was found. Dylan was recognized even though, unlike today, he did not even have a beard then.

Our research shows: PimEyes is a wholesale attack on anonymity and possibly illegal. A snapshot may be enough to identify a stranger using PimEyes. The search engine does not directly provide the name of a person you are looking for. But if it finds matching faces, in many cases the displayed websites can be used to find out name, profession and much more.

👀 👉🏼 🇬🇧 PimEyes - A Polish company just abolishes our anonymity
https://netzpolitik.org/2020/pimeyes-face-search-company-is-abolishing-our-anonymity/

👀 👉🏼 🇩🇪: https://netzpolitik.org/2020/gesichter-suchmaschine-pimeyes-schafft-anonymitaet-ab/

👀 👉🏼 🇬🇧 https://www.bbc.com/news/technology-53007510

👀 👉🏼 🇬🇧 https://petapixel.com/2020/06/11/this-creepy-face-search-engine-scours-the-web-for-photos-of-anyone/

👀 👉🏼 🇩🇪 Automated face recognition -
Enforce our data protection rights at last!
https://netzpolitik.org/2020/automatisierte-gesichtserkennung-setzt-unsere-datenschutzrechte-endlich-auch-durch/

#PimEyes #facialrecognition #searchengine #privacy #anonymity #ourdata #thinkabout
📡@cRyPtHoN_INFOSEC_DE
📡
@cRyPtHoN_INFOSEC_EN
📡
@BlackBox_Archiv
📡
@NoGoolag
Home router warning: They're riddled with known flaws and run ancient, unpatched Linux

And there are no routers in the study from the Fraunhofer Institute without known security flaws.

Germany's Fraunhofer Institute for Communication (FKIE) has carried out a study involving 127 home routers from seven brands to check for the presence of known security vulnerabilities in the latest firmware. The results are appalling.

The FKIE study found that 46 routers hadn't got a single security update within the past year and that many routers are affected by hundreds of known vulnerabilities.

https://www.zdnet.com/article/home-router-warning-theyre-riddled-with-known-flaws-and-run-ancient-unpatched-linux/

#wireless
Forwarded from cRyPtHoN INFOSEC (EN)
California reportedly launches antitrust investigation into Google.

According to a report in Politico, California has become the 49th state to launch an antitrust investigation into Google.

California and Alabama were the only states that did not participate in an antitrust investigation by 48 states, Puerto Rico and the District of Columbia, that began in September and is focused on Google’s dominance in online advertising and search.

It is still unclear what aspects of Google’s business the reported California investigation will focus on.

https://techcrunch.com/2020/07/09/california-reportedly-launches-antitrust-investigation-into-google/

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag
Forwarded from cRyPtHoN INFOSEC (EN)
Join EFF's 30th Anniversary Livestream and Party Like It's 1990!

On Friday, July 10, 1990, the Electronic Frontier Foundation was officially born. It's safe to say that on that day, co-founders Mitch Kapor, John Perry Barlow, and John Gilmore, with critical help from Steve Wozniak, were ahead of their time in imagining that there needed to be an organization that fought to protect ordinary people's access to new technology that could instantly erase distance, create connection, and access much of the world’s knowledge. Today—thirty years later—that technology affects and is affected by most everything we do.

✳️✳️ RVSP ✳️✳️

https://www.eff.org/deeplinks/2020/07/join-effs-30th-anniversary-livestream-and-party-its-1990

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag
Security cameras can tell burglars when you're not home, study shows

Some popular home security cameras could allow would-be burglars to work out when you've left the building, according to a study published Monday.
Researchers found they could tell if someone was in, and even what they were doing in the home, just by looking at data uploaded by the camera and without monitoring the video footage itself.
The international study was carried out by researchers from Queen Mary University of London (QMUL) and the Chinese Academy of Science, using data provided by a large Chinese manufacturer of Internet Protocol (IP) security cameras.

Cameras like these allow users to monitor their homes remotely via a video feed on the internet, but the researchers say the traffic generated by the devices can reveal privacy-compromising information.

https://edition.cnn.com/2020/07/06/tech/home-security-cameras-risks-scli-intl-scn/index.html
More pre-installed malware has been found in budget US smartphones

Cheap phones often have tradeoffs but researchers say this should never compromise user safety.

Back in January, cybersecurity researchers from Malwarebytes discovered unremovable malware bundled with the Android operating systems on the Unimax (UMX) U686CL, a low-end handset sold by Assurance Wireless as part of the Lifeline Assistance program, a 1985 US initiative which subsidizes telephone services for low-income families.

There was no way to remove a pair of apps on the handsets which would install other software on the devices without the user's knowledge.

Now, Malwarebytes has uncovered another budget handset with similar security issues.

The smartphone in question is the ANS (American Network Solutions) UL40, running Android OS 7.1.1.

https://www.zdnet.com/article/more-pre-installed-malware-has-been-found-in-budget-us-smartphones/

#android #malware
Huawei infiltration in Uganda

Unwanted Witness, our partner organisation based in Uganda, explore critical questions Huawei's surveillance dealings with the Ugandan government raise. While Huawei's relationship with the government raises concerns for human rights, many of these concerns remain unaddressed.

Key findings

📝The Uganda government has a contract with Huawei to supply and install surveillance equipment in cities throughout Uganda

📝 Details about the contract remain sectret - and it's not clear whether the procurement was legal or how much Huawei will get out of the project

📝 There could be significant human rights immplications to the project, Huawei technicians have, reportedly, already helped security personal spy on political opponents

📝 Police plan on integrating these systems with other key agencies, including the revenue office, identification authority, and immigration office

https://privacyinternational.org/case-study/3969/huawei-infiltration-uganda

Related post

#africa #uganda #huawei #china #surveillance
No Cookies, No Problem — Using ETags For User Tracking

As a Senior Digital Analytics Consultant at a leading international analytics vendor, I have been keeping a close eye on the current crusade of modern web browsers against cookie technology.

Turns out, there is a way to track individual non-signed in users without using cookies. I implemented it. Here is how.

One quick opening remark: The whole point of this piece is to spark discussion and awareness in the industry and among users. Personally, I would never advocate for employing these tracking practices and I am glad to be working for an analytics vendor, that has always put privacy, transparency, and integrity first.

https://levelup.gitconnected.com/no-cookies-no-problem-using-etags-for-user-tracking-3e745544176b

#privacy #tracker