Thursday, April 19, 2012

Google may be able to legally listen in to your Wi-Fi networking

Summary: If you’re working over unencrypted Wi-Fi, Google, and anyone else, may be able to legally listen in to what you’re doing.

If you have the tools and know what you're doing it's easy to spy on people on an open Wi-Fi network.

Recently, the U.S. Federal Communications Commission (FCC) proposed a $25,000 fine against Google for “deliberately impeded and delayed” an ongoing investigation into whether it breached federal laws over its street-mapping service that peeked in on open, unencrypted, Wi-Fi access points (AP). Read that again, Google wasn’t fined for collecting and storing data from unencrypted wireless networks. They were fined a slap on the wrist amount for not answering the FCC questions as quickly and as thoroughly as the FCC would have liked. The actual snooping in on people Wi-Fi AP and communications–that’s OK.

Google argued that “the Wiretap Act permits the interception of unencrypted Wi-Fi communications. The FCC agreed. To quote from the FCC’s Notice of Apparent Liability for the Google case, “It shall not be unlawful under this chapter or chapter 121 of this title for any person … to intercept or access an electronic communication made through an electronic communication system that is configured so that such electronic communication is readily accessible to the general public.” In short, if your Wi-Fi isn’t configured to be secure by the use of WPA (Wi-Fi Protected Access), WPA2 (Wi-Fi Protected Access 2) or even the long broken Wired Equivalency Privacy (WEP), then by the FCC’s rules it’s not illegal to listen in on it.

As the FCC warns you in its FCC Consumer Tip Sheet: Wi-Fi Networks and Consumer Privacy, “consumers are at risk when they transmit sensitive information - such as credit card numbers and passwords - over public Wi-Fi networks.” Now, if someone grabs that information and uses it for illegal purposes-say they buy themselves an iPad 3 with your credit card number–that’s another story. But, simply grabbing your data as you transmit it in the clear over your local coffee shop’s network, the FCC doesn’t have a problem with that.

It’s also trivial to do. The Firefox-based ethical hacking program, Firesheep showed that anyone can grab your data from an open network. Anyone who knows the first thing about network administration can use network protocol analyzers like WireShark to track your ever move on an unsecured network.

As Jason Glassberg, co-founder of Casaba, a cyber-security firm based in Seattle observed, while “the questions of legality are beyond our purview, however I do believe there needs to be a distinction between collecting unencrypted data and using that data for malicious purposes. I can drive around all day collecting information from unencrypted networks, but as soon as I use any of that data, even if it’s to join that network as an unauthorized user, I have a crossed a line.”
Dr. John Michener, Casaba’s chief scientist adds that, “If you make an analogy to shortwave radio and radio HAMs you would expect that unencrypted radio communications are expected to be intercepted. This is clearly not the use context of Wi-Fi. Until recently, people tended to use unprotected Wi-Fi, which allows easy interception. If viewed this way, the user doesn’t care–because if the user cared, they would have set either WEP (essentially broken) or WPA protection.” And, that is how the FCC sees it, but is that all there is to it?

Richard Santalesa, an attorney with the Information Law Group states that “it’s a violation of many state laws to tap into another’s Internet access (outside of say McDonald’s, Starbucks, the library etc which expressly provided the service for same) under various theft of service laws.”
Attorneys at the local level agree. Mark Hankins, an attorney in Florida, thinks, “tapping Wi-Fi would be a third-degree felony” because according to the Florida law 815.06,
Whoever willfully, knowingly, and without authorization:?

(1)(a) Accesses or causes to be accessed any computer, computer system, or? computer network; … commits an offense against computer users.
Except as provided in paragraphs (b) and (c), whoever violates subsection (1) commits a felony of the third degree.”?(2)(a)

Andrew Jacobson, founder of the Bay Oak Law firm, believes that unauthorized listening of unencrypted Wi-Fi might break a national law as well. Under 18 USC 1030, Fraud and related activity in connection with computers, “Accessing someone else’s Wi-Fi is arguably a criminal offense, because you are accessing computers (in this case, the Internet) without the authority of the Wi-Fi’s owner. Interestingly, it would probably not be a civil offense under the same law, because that requires more than $5000 in damages in one year.”

So is the FCC wrong? Maybe. Maybe not. Other experts think “Ultimately, the FCC controls how radio transmissions are used and it’s that agency’s rules that apply. In general, the FCC preempts any state regulations involving the radio spectrum.”

We can argue for ages though about whose rules apply, whether it’s illegal or not to eavesdrop, on someone’s unprotected Wi-Fi. Here’s the simple real-world truth, says Seth David Schoen, the Electronic Frontier Foundation’s (EFF) Senior Staff Technologist, “it’s easy to intercept data from open Wi-Fi networks and users should be using encryption whenever they use the Internet. Not everyone with a van is going to get caught.”

Exactly. If you’re going to use open Wi-Fi networks you should use Virtual Private Networks (VPN)s or the EFF’s HTTPS Everywhere to help secure your Web site connections. If you don’t, well, be ready to have your information tapped by any Tom, Dick, or Harry. And, depending on the circumstances, be prepared to deal with them being able to get away with it in a court of law as well.

https://www.zdnet.com/blog/networking/google-may-be-able-to-legally-listen-in-to-your-wi-fi-networking/2239

Tuesday, April 17, 2012

Feds shutter online drug market that used Tor to mask activities

Online storefront provided order forms and accepted various forms of payment, including PayPal and Western Union, according to an unsealed indictment.

Eight men have been arrested and charged with distributing more $1 million in LSD, ecstasy, and other narcotics through an online storefront that hid the identities of the service's users.
The online drug market -- known as "The Farmers Market" -- used the Tor Project to allow suppliers to anonymously sell their wares online to buyers in 35 countries, including the United States, according to a federal grand jury indictment unsealed today in Los Angeles. The store provided buyers with order forms, forums, and customer service, and accepted various forms of payment, including PayPal and Western Union, according to the 66-page indictment.

Between January 2007 and October 2009, the sophisticated online marketplace processed more than 5,200 orders worth more than $1 million, authorities said. The ring, which allegedly began operations in March 2006, was busted by a two-year investigation dubbed "Operation Adam Bomb."

"The drug trafficking organization targeted in Operation Adam Bomb was distributing dangerous and addictive drugs to every corner of the world, and trying to hide their activities through the use of advanced anonymizing on-line technology," Briane Grey, U.S. Drug Enforcement Administration acting special agent in charge, said in statement. "Today's action should send a clear message to organizations that are using technology to conduct criminal activity that the DEA and our law enforcement partners will track them down and bring them to justice."

Marc Willems, 42, the accused creator and ringleader of the marketplace, was arrested today by Dutch authorities at his home in Lelystad, Netherlands, authorities said. Michael Evron, also 42, a U.S. citizen living in Argentina who allegedly administered the site with Willems, was arrested Sunday as he was attempting to leave Colombia.

The 12-count indictment charges all eight men with conspiracy to distribute controlled substances and money laundering. Some of the men also are charged with distributing LSD and taking part in a continuing criminal enterprise. Each faces life in prison if convicted.
The U.S.-based Tor Project, which is devoted to providing a system that lets people use the Internet anonymously, is perhaps best known for helping Iranians sidestep increased Internet restrictions put in place by the country's government. Some 50,000 and 60,000 people reportedly use Tor daily in Iran.

Friday, April 13, 2012

New Chromebooks boot in 5 seconds thanks to open source BIOS

So-called “instant on” options have yet to become truly instant, but we’re getting closer. An updated Samsung Chromebook that was just shown off at IDF in Beijing, for example, can perform a cold boot in just five seconds. You’ve still got to log in after that to get at your Chrome OS desktop, of course, but it’s still a pretty impressive feat.

Current generation Chromebooks like the Samsung Series 5 and Acer AC700 take around eight or nine seconds to boot. Thanks to this new model’s updated processor (thought to be a Sandy Bridge chip) and a lot of time spent tweaking Coreboot, a Linux-based replacement for the proprietary BIOS options from companies like Award and AMI, there’s almost no need to bother with sleep states on Chromebooks any more.

The prototype here closely resembles a unit that Samsung had on display at CES 2012, which was running a dual-core Celeron chip — a healthy upgrade over the original Series 5, which sported a slightly underwhelming Atom N570 chip clocked at 1.66GHz.

Google recently introduced an impressive software renderer in Chrome that helped to alleviate some of the performance issues, but with that new Aura interface turning Chrome OS into a more full-featured operating system, new Chromebooks stand to benefit greatly from an upgrade in horsepower.

Google’s not the only company focused on imperceptible boot times, of course. About a year ago, Microsoft showed off an HP laptop that reached the Metro desktop in just eight seconds from a powered-down state. Nobody likes to wait, and fortunately everyone developing operating systems seems determined to make sure we don’t have to when it comes to using our computers.

http://www.geek.com/articles/chips/new-chromebooks-boot-in-5-seconds-thanks-to-open-source-bios-20120413/

Wednesday, April 11, 2012

After Best Buy Swipes His Driver's License: No Returns For 90 Days

Peter Peel of Middletown thought he had all the twists and turns he needed for at least a day when he bought "The French Connection" Blu-ray disc from Best Buy in early March.
Unfortunately, the disc proved defective so, three days later, he brought it back to the Best Buy in Newington. That's when he got the surprise ending.

Despite having the receipt, Peel was also asked for his driver's license. (Unlike the "French Connection, however, no one asked if he had ever picked his feet in Poughkeepsie.) After an employee swiped the license, Peel was told the movie-disc return would be accepted but the store would not authorize any other returns or exchanges for 90 days.

"I was told that I could not return or exchange any other items, even with a valid receipt," he says, "because of some third-party return activity company. How can this be legal when a consumer clearly has a valid receipt?"

It's not only legal, but many other retailers are using The Retail Equation, a California company that verifies return authorizations by tracking consumers' return-exchange behavior at participating stores. It checks the purchase price and whether the consumer had a receipt.
Throw in the driver's-license scanning and it strikes a lot of consumers like Peel as invasive, even creepy.

"Our system is compliant with all state and federal laws regarding the security and privacy of the information," says Best Buy spokeswoman Kelly Groehler, "and provides far greater security than more traditional retail return practices, such as collecting consumer information on hard-copy return slips or saving consumer information on paper logs."

Best Buy adopted the program more than a year ago to reduce fraudulent returns: the big-screen television bought the Friday before the Super Bowl and returned the day after or the video camera purchased before graduation weekend and quickly returned.

Best Buy, already beaten down by consumers who use its stores as a showroom before ordering more cheaply online, also must deal with fraudulent receipts, returns of stolen merchandise for cash and price switching. The retailer can't afford to bleed any more money: The company Forbes earlier this year said is moving toward bankruptcy recently announced it would close 50 stores and lay off 400 workers in the United States. And Tuesday, CEO Brian Dunn resigned.

The Retail Equation says its Verify-2 software identifies the 1 percent of consumers whose behavior can be identified as return fraud or abuse. The company, whose software is in 20,000 stores throughout the country, says return fraud ranges from $14.3 billion to $18.4 billion each year.

"Verify-2 enables retailers to rely on objective, verifiable data," says spokeswoman Lisa Mendenhall, "to determine whether a return is valid rather than relying on subjective observations and guesswork by sales clerks. This objectivity ensures that only those with highly suspect return-and-exchange behavior are affected. The vast majority — approximately 99 percent — of returns are accepted."

Peel said he had several returns after Christmas, then a few other returns and exchanges — all with a receipt. That, apparently, was enough to put him on The Retail Equation's most-wanted list and Best Buy's no-returns-or-exchanges-for-90-days list.

The Retail Equation says its consumer profiles use frequency of returns, dollar amounts, whether a return-receipt was involved and purchase history. It does not use information on age, race, gender, nationality, marital status or whether the consumer is a Yankees or Red Sox fan.
If a sales clerk scans your original sales receipt or swipes your driver's license (a government-issued ID, like a passport, is also accepted) then you're probably shopping at an affiliate of The Retail Equation.

What are your rights? If you've been denied a return or exchange or have been put on a 90-day hold, you can request an activity report from The Retail Equation by sending an email to returnactivityreport@theretailequation.com with both your name and phone number. A Retail Equation representative will call, not write, asking for a return transaction ID and the last four digits of the customer's ID (driver's license or passport) number.
And if it's a little too invasive or too creepy, you can always shop elsewhere.

http://www.courant.com/business/custom/consumer/hc-bottom-line-best-buy-returns-20120409,0,5063368.column?rss

Thursday, April 5, 2012

Chinese websites 'defaced in Anonymous attack'

The Anonymous hacking group claims to have defaced almost 500 websites in China, including government sites, its official agencies, trade groups and many others.

A message put on the hacked sites said the attack was carried out to protest against the Chinese government's strict control of its citizens and urged the Chinese people to join Anonymous and stage their own protests against the regime.

The announcement about the defacements was made via an Anonymous China account that was established in March. A list of the 485 sites affected was put on the Pastebin website. Separate Pastebin messages posted email addresses and other personal details stolen when sites were penetrated.

Sites defaced had the same message posted to them that chided the nation's government for its repressive policies: "Dear Chinese government, you are not infallible, today websites are hacked, tomorrow it will be your vile regime that will fall."

China has one of the most comprehensive web surveillance systems in the world, known as the Great Firewall of China, that reinforces its broader social controls. The system polices where Chinese people can go online and tries to restrict what they can talk about.

On defaced pages, the Anonymous attackers also posted links to advice that could help people avoid official scrutiny of what they do and say online. Much of the advice was in English so it is unclear how much help it would be.

News wires reported that government officials had denied any had taken place.
However, many of the sites listed are now offline and a few others displayed a hacked page for a long time rather than their own homepage.
The Anonymous hackers reportedly successfully attacked some sites a second time once the original defacement was cleaned up.

http://www.bbc.co.uk/news/technology-17623939

Thursday, March 1, 2012

U.S. court authorizes warrantless cell phone search

A U.S. federal appeals court ruled today that police officers can search a cell phone without a warrant.

The searches are to be limited to the device’s number; having the number enables officers of the law to request other, more specific information from carriers, such as call histories.

While the judges sitting on the appeals court panel said that obtaining a cell phone number from a cell phone without a warrant was akin to getting a personal address from a pocket diary without a warrant (which is also legal), they drew the line at doing any other kind of warrantless gadget search.

Also at play, both attorneys and judges in the case noted, are matters of remote data destruction (on the part of alleged criminals, who are often able to erase all data on a cell phone remotely, wiping it clean of evidence) and remote observation via webcams or mobile cameras (on the part of law enforcement, who could end up using gadgets for warrantless surveillance if unchecked).

“Lurking behind this issue is the question whether and when a laptop or desktop computer, tablet, or other type of computer (whether called a ‘computer’ or not) can be searched without a warrant,” Judge Richard Posner wrote in the court’s decision.

Ultimately, that issue is still at play. This law only seems to concern minimally intrusive searches of phones, but more extensive searches require more justification or maybe a warrant

While technology is still evolving too rapidly for many hard rules to be written immediately, a Supreme Court decision should be made. The searches of electronic storage devices should be allowed under the search incident to arrest exception if there is reason to believe evidence of the crime of arrest will be found on the phone, but not allowed if there is no such evidence.

http://venturebeat.com/2012/03/01/warrantless-cell-phone-search/

Wednesday, February 22, 2012

Medically Prescribed Apps

The UK Department of Health called for people to submit new ideas about new or existing smartphone apps to support the country’s healthcare, and nearly 12,600 votes were cast.

“Developing smartphone apps is the next step in giving patients the information and advice they need and want to stay healthy,” the health department said in a statement.

The apps are aimed at helping patients manage long-term conditions like diabetes, post-traumatic stress and high blood pressure, as well as helping people locate public clinics on a map, and educating people on ways to keep fit and eat healthy.

UK health officials said that healthcare apps are already being used by 15,000 patients like cancer sufferers, and pregnant women as well as those with diabetes, heart problems or lung conditions.

Innovation and technology can revolutionize the health service, and we are looking at how the NHS can use these apps for the benefit of patients, including how GPs could offer them for free,” he added.

Further details will be revealed this spring.

http://medicaldaily.com/news/20120222/9157/uk-prescription-mobile-phone-smartphone-app-check-up.htm