Once upon a time, we actually enjoyed privacy

[kscarbel2]

Wikileaks publishes details of wide-ranging hacking tools used by the CIA

BBC  /  March 7, 2017

The alleged cyber-weapons are said to include malware that targets Windows, Android, iOS, OSX and Linux computers as well as internet routers.

Some of the software was developed in-house, and the UK's MI5 agency helped build a spyware attack for Samsung TVs.

Wikileaks said that its source had shared the details with it to prompt a debate into whether the CIA's hacking capabilities had exceeded its mandated powers.

Embarrassment factor - Analysis by BBC's security correspondent Gordon Corera

These latest leaks - which appear to give details of highly sensitive technical methods - will be a huge problem for the CIA.

There is the embarrassment factor - that an agency whose job is to steal other people's secrets has not been able to keep their own.

Then there will be the fear of a loss of intelligence coverage against their targets who may change their behavior because they now know the spies can do.

And then there will be the questions over whether the CIA's technical capabilities were too expansive and too secret.

Because many of the initial documents point to capabilities targeting consumer devices, the hardest questions may revolve around what is known as the "equities" problem.

This is when you find a vulnerability in a piece of technology how do you balance the benefit to the public of telling the manufacturer so they can close it and improve everyone's security with the benefit to the spy agency of leaving it in place so they can exploit it to collect intelligence.

The NSA has already faced questions about whether it has this balance right when many of its secrets were revealed by Edward Snowden, and now it may be the CIA's turn.

Hacked TVs

The effort to compromise Samsung's F8000 range of smart TVs was codenamed Weeping Angel, according to documents dated June 2014.

They describe the creation of a "fake-off" mode, designed to fool users into believing that their screens had been switched off.

Instead, the documents indicate, infected sets were made to covertly record audio, which would later be transferred over the internet to CIA computer servers once the TVs were fully switched back on, allowing their wi-fi links to re-establish.

Under a "future work" section, it is suggested that video snapshots might also be taken and the wi-fi limitation be overcome.

 

[kscarbel2]

 

[kscarbel2]

WikiLeaks says U.S. Frankfurt consulate is a 'CIA hacker base'

The Local de  /  March 7, 2017

The whistleblower group's new report describes how the CIA hacked into iPhones, Microsoft Windows and even Samsung TVs around the world - and the German financial centre is reportedly a major hub.

In a leak described by the whistleblower organization as “the largest intelligence publication in history”, WikiLeaks released nearly 9,000 documents that it says reveal the CIA's hacking arsenal.

“The quantity of published pages… already eclipses the total number of pages published over the first three years of the Edward Snowden NSA leaks,” WikiLeaks states.

One expert who examined the leaks told the Associated Press that it appeared legitimate.

WikiLeaks said the “Vault 7” release on Tuesday exposes the “entire hacking capacity” of the American intelligence organization and how it covertly hacks into devices like iPhones, Android phones, Microsoft Windows and even Samsung TVs, turning them into secret microphones.

It claims that by the end of last year, the CIA's hacking unit had more than 5,000 registered users who had produced thousands of hacking systems, trojans, viruses and “weaponized” malware.

“The CIA had created, in effect, its "own NSA" with even less accountability and without publicly answering the question as to whether such a massive budgetary spend on duplicating the capacities of a rival agency could be justified,” WikiLeaks states in the release.

The source of the leak is said to be a former US government hacker or contractor, who was able to get hold of the documentation after the CIA lost control of most of its hacking arsenal, WikiLeaks states.

The US Consulate in Frankfurt was reportedly used as a “covert base” for hackers in Europe, the Middle East and Africa. These hackers were given diplomatic passports with State Department cover, and were instructed to tell customs officials that they were technical consultants for the consulate.

Once in Frankfurt, WikiLeaks says the hackers could travel without border checks throughout Europe's Schengen area. Hackers would then target certain workplaces with USB sticks containing malware, and insert the sticks into a computer to infect or exfiltrate data.

One attack system, Fine Dining, reportedly has 24 decoy applications for hackers to use, making a computer screen display videos, slideshow presentations, fake virus scanners, or computer games - all while the malware attacks the system.

"As a matter of policy, the US State Department does not comment on specific intelligence allegations," the Frankfurt Consulate told The Local, declining to comment on whether the documents were authentic.

The report also says that by 2014, the CIA had started looking into how to infect vehicle control systems, potentially for the purpose of conducting undetectable assassinations.

[kscarbel2]

WikiLeaks publishes 1000s of CIA documents

WJLA/Associated Press  /  March 7, 2017

WikiLeaks on Tuesday published thousands of documents purportedly taken from the Central Intelligence Agency's Center for Cyber Intelligence, a dramatic release that appears to provide an eye-opening look at the intimate details of America's cyberespionage toolkit.

The dump could not immediately be authenticated by The Associated Press and the CIA declined comment, but WikiLeaks has a long track record of releasing top secret government documents.

Experts who've started to sift through the material said it appeared legitimate and that the release was almost certain to shake the CIA.

"There's no question that there's a fire drill going on right now," said Jake Williams, a security expert with Augusta, Georgia-based Rendition Infosec. "It wouldn't surprise me that there are people changing careers and ending careers as we speak."

If it did prove legitimate, the dump would represent yet another catastrophic breach for the U.S. intelligence community at the hands of WikiLeaks and its allies, which have repeatedly humbled Washington with the mass release of classified material, including hundreds of thousands of documents from the State Department and the Pentagon.

WikiLeaks, which had been dropping cryptic hints about the release for a month, said in a lengthy statement that the CIA had "recently" lost control of a massive arsenal of CIA hacking tools as well as associated documentation. The radical transparency organization said that "the archive appears to have been circulated among former U.S. government hackers and contractors in an unauthorized manner" and that one of them "provided WikiLeaks with portions of the archive."

Jonathan Liu, a spokesman for the CIA, said: "We do not comment on the authenticity or content of purported intelligence documents."

Williams, who has experience dealing with government hackers, said that the voluminous files' extensive references to operation security meant they were almost certainly government-backed.

"I can't fathom anyone fabricated that amount of operational security concern," he said. "It rings true to me."

"The only people who are having that conversation are people who are engaging in nation-state-level hacking," he said.

[kscarbel2]

'I'm not going to comment on that,' White House press secretary Sean Spicer told reporters. 'I think obviously that's not something that has been fully evaluated. And if it was, I would not comment from here on that.'

[kscarbel2]

WikiLeaks publishes 'biggest ever leak of secret CIA documents'

The Guardian  /  March 7, 2017

The 8,761 documents published by WikiLeaks focus mainly on techniques for hacking and surveillance

The US intelligence agencies are facing fresh embarrassment after WikiLeaks published what it described as the biggest ever leak of confidential documents from the CIA detailing the tools it uses to break into phones, communication apps and other electronic devices.

The thousands of leaked documents focus mainly on techniques for hacking and reveal how the CIA cooperated with British intelligence to engineer a way to compromise smart televisions and turn them into improvised surveillance devices.

The leak, named “Vault 7” by WikiLeaks, will once again raise questions about the inability of US spy agencies to protect secret documents in the digital age. It follows disclosures about Afghanistan and Iraq by army intelligence analyst Chelsea Manning in 2010 and about the National Security Agency and Britain’s GCHQ by Edward Snowden in 2013.

The new documents appear to be from the CIA’s 200-strong Center for Cyber Intelligence and show in detail how the agency’s digital specialists engage in hacking. Monday’s leak of about 9,000 secret files, which WikiLeaks said was only the first tranche of documents it had obtained, were all relatively recent, running from 2013 to 2016.

The revelations in the documents include:

• CIA hackers targeted smartphones and computers.
• The Center for Cyber Intelligence, based at the CIA headquarters in Langley, Virginia, has a second covert base in the US consulate in Frankfurt which covers Europe, the Middle East and Africa.
• A programme called Weeping Angel describes how to attack a Samsung F8000 TV set so that it appears to be off but can still be used for monitoring.

The CIA declined to comment on the leak beyond the agency’s now-stock refusal to verify the content. “We do not comment on the authenticity or content of purported intelligence documents,” wrote CIA spokesperson Heather Fritz Horniak. But it is understood the documents are genuine and a hunt is under way for the leakers or hackers responsible for the leak.

WikiLeaks, in a statement, was vague about its source. “The archive appears to have been circulated among former US government hackers and contractors in an unauthorised manner, one of whom has provided WikiLeaks with portions of the archive,” the organisation said.

The leak feeds into the present feverish controversy in Washington over alleged links between Donald Trump’s team and Russia. US officials have claimed WikiLeaks acts as a conduit for Russian intelligence and Trump sided with the website during the White House election campaign, praising the organisation for publishing leaked Hillary Clinton emails.

Asked about the claims regarding vulnerabilities in consumer products, Sean Spicer, the White House press secretary, said: “I’m not going to comment on that. Obviously that’s something that’s not been fully evaluated.”

Asked about Trump’s praise for WikiLeaks during last year’s election, when it published emails hacked from Clinton’s campaign chairman, Spicer told the Guardian: “The president said there’s a difference between Gmail accounts and classified information. The president made that distinction a couple of weeks ago.”

Julian Assange, the WikiLeaks editor-in-chief, said the disclosures were “exceptional from a political, legal and forensic perspective”. WikiLeaks has been criticised in the past for dumping documents on the internet unredacted and this time the names of officials and other information have been blacked out.

WikiLeaks shared the information in advance with Der Spiegel in Germany and La Repubblica in Italy.

Edward Snowden, who is in exile in Russia, said in a series of tweets the documents seemed genuine and that only an insider could know this kind of detail. He tweeted:

 

Edward Snowden (@Snowden)

Still working through the publication, but what @Wikileaks has here is genuinely a big deal. Looks authentic.

March 7, 2017

 

Edward Snowden (@Snowden)

If you're writing about the CIA/@Wikileaks story, here's the big deal: first public evidence USG secretly paying to keep US software unsafe. pic.twitter.com/kYi0NC2mOp

March 7, 2017

 

Edward Snowden (@Snowden)

The CIA reports show the USG developing vulnerabilities in US products, then intentionally keeping the holes open. Reckless beyond words.

March 7, 2017

 

The document dealing with Samsung televisions carries the CIA logo and is described as secret. It adds “USA/UK”. It says: “Accomplishments during joint workshop with MI5/BTSS (British Security Service) (week of June 16, 2014).”

It details how to fake it so that the television appears to be off but in reality can be used to monitor targets. It describes the television as being in “Fake Off” mode. Referring to UK involvement, it says: “Received sanitized source code from UK with comms and encryption removed.”

WikiLeaks, in a press release heralding the leak, said: “The attack against Samsung smart TVs was developed in cooperation with the United Kingdom’s MI5/BTSS. After infestation, Weeping Angel places the target TV in a ‘Fake Off’ mode, so that the owner falsely believes the TV is off when it is on. In ‘Fake Off’ mode the TV operates as a bug, recording conversations in the room and sending them over the internet to a covert CIA server.”

The role of MI5, the domestic intelligence service, is mainly to track terrorists and foreign intelligence agencies and monitoring along the lines revealed in the CIA documents would require a warrant.

The Snowden revelations created tension between the intelligence agencies and the major IT companies upset that the extent of their cooperation with the NSA had been exposed. But the companies were primarily angered over the revelation the agencies were privately working on ways to hack into their products. The CIA revelations risk renewing the friction with the private sector.

The initial reaction of members of the intelligence community was to question whether the latest revelations were in the public interest.

A source familiar with the CIA’s information security capabilities took issue with WikiLeaks’s comment that the leaker wanted “to initiate a public debate about cyberweapons”. But the source said this was akin to claiming to be worried about nuclear proliferation and then offering up the launch codes for just one country’s nuclear weapons at the moment when a war seemed most likely to begin.

Monday’s leaks also reveal that CIA hackers operating out of the Frankfurt consulate are given diplomatic (“black”) passports and US State Department cover. The documents include instructions for incoming CIA hackers that make Germany’s counter-intelligence efforts appear inconsequential.

The document reads:

“Breeze through German customs because you have your cover-for-action story down pat, and all they did was stamp your passport.

Your cover story (for this trip):

Q: Why are you here?

A: Supporting technical consultations at the consulate.”

The leaks also reveal a number of the CIA’s electronic attack methods are designed for physical proximity. These attack methods are able to penetrate high-security networks that are disconnected from the internet, such as police record databases. In these cases, a CIA officer, agent or allied intelligence officer acting under instructions, physically infiltrates the targeted workplace. The attacker is provided with a USB stick containing malware developed for the CIA for this purpose, which is inserted into the targeted computer. The attacker then infects and extracts data.

A CIA attack system called Fine Dining provides 24 decoy applications for CIA spies to use. To witnesses, the spy appears to be running a programme showing videos, presenting slides, playing a computer game, or even running a fake virus scanner. But while the decoy application is on the screen, the system is automatically infected and ransacked.

The documents also provide travel advice for hackers heading to Frankfurt: “Flying Lufthansa: Booze is free so enjoy (within reason).”

The rights group Privacy International, in a statement, said it had long warned about government hacking powers. “Insufficient security protections in the growing amount of devices connected to the internet or so-called ‘smart’ devices, such as Samsung smart TVs, only compound the problem, giving governments easier access to our private lives,” the group said.

[kscarbel2]

RT  /  March 7, 20107

WikiLeaks has published what it claims is the largest ever batch of confidential documents on the CIA, revealing the breadth of the agency’s ability to hack smartphones and popular social media messaging apps such as WhatsApp.

A total of 8,761 documents have been published as part of ‘Year Zero’, the first part in a series of leaks on the agency that the whistleblower organization has dubbed ‘Vault 7.’

In a statement WikiLeaks said ‘Year Zero’ revealed details of the CIA’s “global covert hacking program,” including “weaponized exploits” used against company products including “Apple's iPhone, Google's Android and Microsoft's Windows and even Samsung TVs, which are turned into covert microphones.”

RELEASE: Vault 7 Part 1 "Year Zero": Inside the CIA's global hacking force https://t.co/h5wzfrReyypic.twitter.com/N2lxyHH9jp

— WikiLeaks (@wikileaks) March 7, 2017

According to the cache of documents released, the CIA's Mobile Devices Branch (MDB) has developed multiple tools and systems to hack popular smart phones and remotely order them to send both location data as well as audio and text communications.

The phones’ cameras and microphones can also be remotely activated at will.

Such tools and techniques allow the CIA to hack social media platforms such as WhatsApp, Signal, Telegram, Wiebo, Confide and Cloackman before encryption can be applied, WikiLeaks claims in the statement on their website.

The time period covered in the latest leak is 2013 to 2016, according to the CIA timestamps on the documents themselves.

CIA negligence sees it losing control of all cyber weapons arsenal sparking serious proliferation concerns #Vault7https://t.co/mHaRNCr3Dfpic.twitter.com/lwapDCKYt9

— WikiLeaks (@wikileaks) March 7, 2017

The source of the information told WikiLeaks in a statement that they wish to initiate a public debate about the “security, creation, use, proliferation and democratic control of cyberweapons.”

Policy questions that should be debated in public include “whether the CIA's hacking capabilities exceed its mandated powers and the problem of public oversight of the agency,” WikiLeaks claims the source said.

READ MORE: Revelations of CIA spying on NATO-ally France 'a nuclear bombshell’

Commenting on the leak, WikiLeaks co-editor Julian Assange said the cache showed the “extreme proliferation risk in the development of cyber 'weapons.”

“The significance of ‘Year Zero’ goes well beyond the choice between cyberwar and cyberpeace. The disclosure is also exceptional from a political, legal and forensic perspective," he said.

The FAQ section of the release yields some key details which highlight the true extent of the leak: firstly, the information was “obtained recently and covers through 2016”.

Secondly, WikiLeaks has asserted that it has not mined the entire leak and has only verified it, asking that journalists and activists do the leg work.

READ MORE: WikiLeaks releases 'CIA espionage orders' for 2012 French presidential election

In WikiLeaks’ analysis of ‘Year Zero’ it detailed ‘Weeping Angel’, a surveillance technique which infiltrates smart TV’s, transforming them into microphones.

An attack against Samsung TV’s used ‘Weeping Angel’ in cooperation with MI5, placing them into a ‘Fake-Off’ mode, recording conversations even when the device appears to be off.

In the released batch “Things you might do” with ‘Weeping Angel’ is detailed in a document. “Investigate any listening ports & their respective services” is listed, along with “extract browser credentials or history.”

.

 

[kscarbel2]

85% of world’s smart phones ‘weaponized’ by CIA

RT  /  March 7, 2017

The majority of the world’s smartphones have been “weaponized,” according to WikiLeaks, which revealed in its latest leak that the CIA went to extreme measures to utilize the Android OS for spying.

Google’s Android operating system, used in 85 percent of the world’s smart phones, including Samsung and Sony, was found to have 24 ‘zero days’ – the code name used by the CIA to identify and exploit vulnerabilities for the purpose of secretly collecting data on individuals.

The techniques allow the CIA to access data from social messaging platforms, including WhatsApp, Weibo and Clockman before encryption, according to WikiLeaks.

Both audio and message data were vulnerable to the exploit through the CIA’s exploitation of gaps in the OS.

WikiLeaks' #Vault7 reveals numerous CIA 'zero day' vulnerabilities in Android phones https://t.co/yHg7AtX5gg https://t.co/g6xpPYly9T

— WikiLeaks (@wikileaks) March 7, 2017

WikiLeaks claims the source of their latest release acted to create a public debate about the “security, creation, use, proliferation and democratic control of cyberweapons.”

The leak revealed details of massive surveillance by the CIA, including ‘Weeping Angel’ – a surveillance technique which infiltrates smart TVs, transforming them into microphones.

#CIA hid ability to #hack smart phones and TVs worldwide from makers, despite #Obama pledge to reveal https://t.co/K7wFTdlC82#Vault7

— WikiLeaks (@wikileaks) March 7, 2017

In one of the documents, users of antivirus software Comodo, who did not install a flawed upgrade, were described as “paranoid bastards.”

The CIA appear to be aware that version 6.X of the software isn’t as good as its predecessor, which they described as a “a colossal pain in the posterior.”

“Comodo's user base, paranoid bastards that they are, has apparently caught wind of this and lots of them haven't upgraded to 6.X.  Kind of a shame, cuz this is a hole you could drive a very large wheeled freight carrying vehicle through,” the document reads.

[kscarbel2]

RT  /   March 7, 2017

The major takeaway from the latest WikiLeaks dump centers around the terrifying, ‘all-seeing-eye’ surveillance project codenamed ‘Weeping Angel.’ The CIA appears to have taken espionage to a whole new level if WikiLeaks’ initial analysis is accurate.

According to the preliminary release, the CIA has the capability to hack, record and even control everyday technology used by billions of people around the world.

These include smartphones, tablets, smart TVs and even vehicles with remote control navigation systems.

On these devices themselves, the CIA can hack into some of the world’s most heavily encrypted social media and communications platforms such as WhatsApp, Weibo, Confide, Signal and Telegram before any encryption can even be applied.

For example, WhatsApp’s end-to-end encryption means that only the direct participants in a conversation can read messages; not even WhatsApp is capable of reading them.

The CIA, however, was able to hack into individual private WhatsApp messages before encryption could even be applied.

“Your messages are secured with a lock, and only the recipient and you have the special key needed to unlock and read your message,” the company writes on their website.

According to WikiLeaks, the manufacturing division for the Agency’s hacking tools, or ‘zero days’ as they are dubbed in the leaks, is the EDG (Engineering Development Group), which is under the umbrella of the agency’s CCI (Center for Cyber Intelligence).

Smartphone devices

The CIA's Mobile Devices Branch (MDB) developed a variety of tools and techniques to remotely hack and control the world’s most popular smartphones and tablets.

Once hacked, phones can be used to transmit their “geolocation, audio and text communications” directly to the CIA without the user’s knowledge. In addition, the CIA can remotely activate the phone’s microphone and camera.

Apple devices

Despite Apple holding a minority share in the global smartphone market in 2016, the CIA’s Mobile Development Branch has a specific division dedicated to the hacking of Apple devices which run the iOS operating system from smartphones and tablets.

WikiLeaks also alleges that the CIA not only developed but collaborated on or purchased a variety of hacking tools or ‘zero days’ from intelligence agencies and contractors around the world such as GCHQ, NSA, FBI or Baitshop.

Samsung

The EDG has produced a ‘zero day’ capable of hacking Samsung smart TVs, switching it into a fake ‘off mode’ where the device appears to remain on standby while actually recording audio and transmitting it to nearby secured CIA servers.

For context, Samsung was the top-selling television brand in the world for the last decade with a global market share of 21 percent as of 2015. WikiLeaks did not specify in the initial release whether video recordings were also a part of this particular ‘zero day.’

Vehicle control

As far back as 2014, WikiLeaks alleges that the CIA was exploring the possibility of infecting control systems in modern cars and trucks. While the exact goal of such control has yet to be established, WikiLeaks suggests that such hacks could be used for almost undetectable assassinations.

Android devices (Samsung, HTC, Sony)

The majority of the world’s smartphones (approximately 85 percent) run on the Android operating system, with roughly 1.15 billion Android devices sold last year, according to the WikiLeaks statement. Naturally, the CIA devoted an entire subdivision to hacking Android devices, with 24 individual weaponized ‘zero days’ targeting Android devices.

Microsoft

The CIA’s cyber division has developed numerous local and remote ‘zero days’ to hack and control Microsoft Windows users. 

These ‘zero days’ include, but are not limited to: air gap jumping viruses such as ‘Hammer Drill’ that are capable of infecting computers or phones that have never been connected to the internet; hacking tools that focus on removable devices such as USB drives; systems for hiding data, be it in covert disk areas or in images; particular ‘zero days’ that are manufactured to self-perpetuate and hide themselves from detection on an ongoing basis.

Before any tech experts gloat, WikiLeaks also alleges that the CIA has developed advanced, multi-platform malware attack and control systems that cover Windows and Mac OS X but also mixed source platforms like Solaris and open source platforms like Linux. Wikileaks names these specific ‘zero days’ as the EDB's ‘HIVE,’ ‘Cutthroat’ and ‘Swindle’ tools.

[kscarbel2]

Daily Mail  /  March 8, 2017

CIA hackers have learned how to adopt the 'fingerprints' of other intelligence services allowing them to carry out 'false flag' attacks.

WikiLeaks, which yesterday released thousands of documents revealing how intelligence services could break into phones, computers and TVs, said the CIA was able to frame foreign spies and hackers for its own operations.

The false flag allegation could be seized upon by Russia's government, which has denied reports by the FBI and CIA that it interfered with last year's presidential election to get Donald Trump elected.

WikiLeaks says UMBRAGE, a sub-group of the CIA's Remote Development Branch, has collected in-depth data on hacking techniques used by other powers, which could include Russia and China.

These techniques can be used to give the impression other parties are guilty of carrying out hacks which are in fact the work of the CIA.

WikiLeaks founder Julian Assange has previously said he is '1,000 per cent' certain that Russia did not carry out hacking operations during the elections. 

A statement from WikiLeaks likened finding hacking culprits to catching a murderer, and said 'fingerprinting' could lead investigators in the wrong direction.

It said: 'The CIA's hand crafted hacking techniques pose a problem for the agency. Each technique it has created forms a "fingerprint" that can be used by forensic investigators to attribute multiple different attacks to the same entity.

'This is analogous to finding the same distinctive knife wound on multiple separate murder victims. The unique wounding style creates suspicion that a single murderer is responsible. 

'As soon one murder in the set is solved then the other murders also find likely attribution.'

The statement continued to state that the CIA has collected information on techniques used by other nations, including Russia.

It said: 'The CIA's Remote Devices Branch's UMBRAGE group collects and maintains a substantial library of attack techniques "stolen" from malware produced in other states including the Russian Federation.

'With UMBRAGE and related projects the CIA cannot only increase its total number of attack types but also misdirect attribution by leaving behind the "fingerprints" of the groups that the attack techniques were stolen from.

'UMBRAGE components cover keyloggers, password collection, webcam capture, data destruction, persistence, privilege escalation, stealth, anti-virus (PSP) avoidance and survey techniques.'

[kscarbel2]

FBI's James Comey: 'There is no such thing as absolute privacy in America'

The Guardian  /  March 8, 2017

FBI director’s assessment deepens privacy concerns raised by the details of CIA tools to hack consumer electronics for espionage, published by WikiLeaks

“There is no such thing as absolute privacy in America,” the FBI director, James Comey, has declared after the disclosure of a range of hacking tools used by the CIA.

Comey was delivering prepared remarks at a cybersecurity conference in Boston, but his assessment has deepened privacy concerns already raised by the details of CIA tools to hack consumer electronics for espionage published by WikiLeaks on Tuesday.

“All of us have a reasonable expectation of privacy in our homes, in our cars, and in our devices. But it also means with good reason, in court, government, through law enforcement, can invade our private spaces,” Comey said at the conference on Wednesday. “Even our memories aren’t private. Any of us can be compelled to say what we saw … In appropriate circumstances, a judge can compel any of us to testify in court on those private communications.”

.

 

[kscarbel2]

 

[RowdyRebel]

Kinda makes me glad I don't have an android, apple, or windows phone, and my windows desktop doesn't have a microphone OR camera.

I have a smart phone...it just isn't an android, apple, or windows OS. Ditto on the no connection between my truck's ECM and the outside world. Want to tinker? Have to be inside the truck physically connected. Not looking forward to installing an ELD...still weighing my options, as that device will provide a doorway into my truck's computer. Wife wants to move, so if I can find a buyer for the house we're gone. Then, I'll either find a job I can run local under the 100 air-mile exemption, or get a regular job. Hell, my NEWEST POV is old enough to drink...just wish this old Mack was 13or so months older to be a late-'99 instead of an early-'01.

[Brocky]

Call me old fashioned but I agree with RR on the old flip phone to talk ONLY, and no connection from my truck computer to the manufacturer..

[kscarbel2]

CIA 'mission' on cars shows concern about next-generation vehicles

Reuters  /  March 9, 2017

WikiLeaks documents showing the Central Intelligence Agency considered a "mission" against connected car technology underscores auto industry concern that the science behind the next generation of vehicles could be turned against them.

Cyber security is considered key to the rollout of tomorrow's self-driving and today's connected cars, which resemble computers on wheels with a host of communications routes that hackers could target.

If consumers are to trust smart vehicles, they must deem them safe from attack. Security experts cite the terrifying hypothetical example of a remote attack on a fully autonomous vehicle with no steering wheel or brakes, in which the passenger would have no recourse to regain manual control of the car.

"You have a lot of car companies trying to design cars to be better suited to automation, which means they're more attractive to hackers," said auto consultant Roger Lanctot of Strategy Analytics.

A major strategy for automakers is to reduce the number of communications gateways to crucial systems and to require services offered by third parties to go through a single secure path.

WikiLeaks documents show the CIA citing "vehicle systems" and a car operating system from QNX, owned by Blackberry Ltd , as "potential mission areas" for the CIA's "Embedded Devices Branch" to consider.

The QNX operating system, which is used by most global automakers, provides a "a comprehensive, multi-level, policy-driven security model ... to mitigate attacks," the company said in a statement to Reuters. But given the collection of software, hardware and network components that make up a connected car, "security is only as strong as its weakest link," it said.

While the CIA's interest in cars brought widespread attention, the industry has already received wakeup calls about cars' potential to be hacked.

Researchers in 2015 used a wireless connection to turn off a Jeep Cherokee's engine, prompting a recall of 1.4 million vehicles by Fiat Chrysler Automobiles.

In September last year, Chinese cyber security researchers hacked a Tesla Inc. Model S sedan, remotely tapping the brakes and popping the trunk. The electric carmaker subsequently patched the bugs using an over-the-air fix. Tesla did not respond to a request for comment on its cyber security protocol.

The hacking of the Jeep and the Tesla "brought it home to the industry that even if its improbable it's technically possible," said Mark Wakefield, global co-head of the automotive practice at AlixPartners.

If a car was seen as vulnerable, it "could be a big brand problem," Wakefield said. Hacks could also expose private information shared between car and third parties - credit card numbers, account numbers or passwords - to theft.

A January survey by the University of Michigan's Transportation Research Institute found that 33 percent of respondents said they were "extremely concerned" over hacking of full self-driving cars to cause crashes.

Closing down the ways in

The number of ways into cars has proliferated, from cell phone signals to dongles. One such gateway is the standard OBD-II port found under the steering wheel historically used for onboard diagnostics. Today, hundreds of after-market devices use the port, whether to monitor driving for insurance needs or provide conveniences like safety alerts.

"The security of these devices is important, as it can provide an attacker with a means of accessing vehicle systems and driver data remotely," warned the FBI in a March 2016 bulletin on cyber security risks to motor vehicles.

Carmakers are also building walls between non-crucial infotainment systems and driving controls so that any breach is blocked before it could compromise key functions like brakes.

The first step the industry is tackling is intrusion detection, said Lanctot. But what to do when a breach is detected is complicated, because shutting off parts of a car could be unsafe, he said.

Tesla was first to champion "over-the-air" technology in which wireless software updates are sent remotely to cars. Although some have argued such updates are a way in for hackers, Tesla and others see them a key protection to upgrade security and repair vulnerabilities quickly.

In January, U.S. lawmakers introduced a bill calling for cyber security standards for new cars but so far U.S. regulators have issued recommendations, not rules, on how carmakers should shield their computer systems from hackers.

The industry is "years away" from solving the cyber security problem, Lanctot said, noting that the first generation of cars built after the Jeep hack that include some kind of detection capabilities will not be seen until early in 2018.

[terry]

ditto on what brocky said, my grandkids say i am old fashioned.    terry

[kscarbel2]

.

.

 

[kscarbel2]

The plot thickens. A good movie this will all make, but we'll never learn the truth.

“an anti-virus expert has come forward to say that sophisticated malware that he had attributed to a state, either Iran, China or Russia, now he believes is from the CIA because the type of attack system it uses corresponds directly to a description we published of that attack system.”

“And it’s rare enough that it seems unlikely that it would be independently discovered, unless of course China has already gotten hold of these parts of the CIA arsenal and that China is using them to pretend to be the CIA.”

[kscarbel2]

U.S. Senate votes to overturn Obama broadband privacy rules

Reuters  /  March 23, 2017

The U.S. Senate on Thursday voted to repeal regulations requiring internet service providers to do more to protect customers' privacy than websites like Alphabet Inc's Google or Facebook Inc.

The vote was along party lines, with 50 Republicans approving the measure and 48 Democrats rejecting it. The two remaining Republicans in the Senate were absent and did not cast a vote.

According to the rules approved by the Federal Communications Commission (FCC) in October under then-President Barack Obama, internet providers would need to obtain consumer consent before using precise geolocation, financial information, health information, children's information and web browsing history for advertising and internal marketing.

The vote was a victory for internet providers such as AT&T, Comcast and Verizon Communications, which had strongly opposed the rules.

The bill next goes to the U.S. House of Representatives.

Senate Majority Leader Mitch McConnell said the Senate was overturning a regulation that "makes the internet an uneven playing field, increases complexity, discourages competition, innovation, and infrastructure investment." [Good luck selling that line, Mitch]

But Democratic Senator Ed Markey said, "Republicans have just made it easier for American’s sensitive information about their health, finances and families to be used, shared, and sold to the highest bidder without their permission."

In a joint statement, Democratic members of the FCC and the Federal Trade Commission said the Senate vote "creates a massive gap in consumer protection law as broadband and cable companies now have no discernible privacy requirements."

Republican commissioners said in October that the rules would unfairly give websites like Facebook, Twitter and Google the ability to harvest more data than internet service providers and thus dominate digital advertising.

[DailyDiesel]

It's simple, just stop using the internet. 

As if life isn't easy enough for our corporate overlords.

[kscarbel2]

 

 

[kscarbel2]

 

[kscarbel2]

Personal details of nearly 200 million US citizens exposed

Sensitive personal details relating to almost 200 million US citizens have been exposed by a marketing firm contracted by the Republican National Committee (RNC).

The 1.1 terabytes of data includes birthdates, home addresses, telephone numbers and political views of 62% of the entire US population.

The data was available on a publicly accessible Amazon cloud server.

Anyone could access the data as long as they had a link to it.

The huge cache of data was discovered last week by Chris Vickery, a cyber-risk analyst with security firm UpGuard. The information was collected from a wide range of sources - from posts on controversial banned threads on the social network Reddit, to committees that raised funds for the Republican Party.

The information was stored in spreadsheets uploaded to a server owned by Deep Root Analytics. It had last been updated in January when President Donald Trump was inaugurated and had been online for an unknown period of time.

"We take full responsibility for this situation. Based on the information we have gathered thus far, we do not believe that our systems have been hacked," Deep Root Analytics' founder Alex Lundry told technology website Gizmodo.

"Since this event has come to our attention, we have updated the access settings and put protocols in place to prevent further access."

Apart from personal details, the data also contained citizens' suspected religious affiliations, ethnicities and political biases, such as where they stood on controversial topics like gun control, the right to abortion and stem cell research.

The file names and directories indicated that the data was meant to be used by influential Republican political organisations. The idea was to try to create a profile on as many voters as possible using all available data, so some of the fields in the spreadsheets were left left empty if an answer could not be found.

"That such an enormous national database could be created and hosted online, missing even the simplest of protections against the data being publicly accessible, is troubling," Dan O'Sullivan wrote in a blog post on Upguard's website.

"The ability to collect such information and store it insecurely further calls into question the responsibilities owed by private corporations and political campaigns to those citizens targeted by increasingly high-powered data analytics operations."

Privacy concerns

Although it is known that political parties routinely gather data on voters, this is the largest breach of electoral data in the US to date and privacy experts are concerned about the sheer scale of the data gathered.

"This is deeply troubling. This is not just sensitive, it's intimate information, predictions about people's behaviour, opinions and beliefs that people have never decided to disclose to anyone," Privacy International's policy officer Frederike Kaltheuner told the BBC News website.

However, the issue of data collection and using computer models to predict voter behaviour is not just limited to marketing firms - Privacy International says that the entire online advertising ecosystem operates in the same way.

"It is a threat to the way democracy works. The GOP [Republican Party] relied on publicly-collected, commercially-provided information. Nobody would have realized that the data they entrusted to one organization would end up in a database used to target them politically.

"You should be in charge of what is happening to your data, who can use it and for what purposes," Ms Kaltheuner added.

There are fears that leaked data can easily be used for nefarious purposes, from identity fraud to harassment of people under protection orders, or to intimidate people who hold an opposing political view.

"The potential for this type of data being made available publicly and on the dark web is extremely high," Paul Fletcher, a cyber-security evangelist at security firm Alert Logic told the BBC.

[kscarbel2]

Uber paid hackers to delete stolen data on 57 million people

Bloomberg  /  November 22, 2017

SAN FRANCISCO -- Hackers stole the personal data of 57 million customers and drivers from Uber Technologies Inc., a massive breach that the company concealed for more than a year.

This week, the ride-hailing firm ousted its chief security officer and one of his deputies for their roles in keeping the hack under wraps, which included a $100,000 payment to the attackers.

Compromised data from the October 2016 attack included names, email addresses and phone numbers of 50 million Uber riders around the world, the company said Tuesday. The personal information of about 7 million drivers was accessed as well, including some 600,000 U.S. driver’s license numbers. No Social Security numbers, credit card information, trip location details or other data were taken, Uber said [Don’t believe it].

At the time of the incident, Uber was negotiating with U.S. regulators investigating separate claims of privacy violations. Uber now says it had a legal obligation to report the hack to regulators and to drivers whose license numbers were taken. Instead, Uber paid hackers to delete the data and keep the breach quiet. Uber said it believes [They have no clue] the information was never used but refused to disclose the identities of the attackers.

“None of this should have happened, and I will not make excuses for it,” Dara Khosrowshahi, who took over as CEO in September. “We are changing the way we do business.” 

After Uber’s disclosure Tuesday, New York Attorney General Eric Schneiderman launched an investigation into the hack. Uber was also sued for negligence over the breach by a customer seeking class-action status.

Hackers have successfully infiltrated numerous companies in recent years. The Uber breach, while large, is dwarfed by those at Yahoo, MySpace, Target Corp., Anthem Inc. and Equifax Inc.

What’s more alarming are the extreme measures Uber took to hide the attack.

Kalanick controversies

The breach is the latest scandal Khosrowshahi inherits from his predecessor, Travis Kalanick.

Kalanick, Uber’s co-founder and former CEO, learned of the hack in November 2016, a month after it took place. Uber had just settled a lawsuit with the New York attorney general over data security disclosures and was in the process of negotiating with the Federal Trade Commission over the handling of consumer data..

Joe Sullivan, the outgoing security chief, spearheaded the response to the hack last year. Sullivan, a onetime federal prosecutor who joined Uber in 2015 from Facebook Inc., has been at the center of much of the decision-making that has come back to bite Uber this year. The board commissioned an investigation into the activities of Sullivan’s security team. This project, conducted by an outside law firm, discovered the hack and the failure to disclose.

Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money.

A patchwork of state and federal laws require companies to alert people and government agencies when sensitive data breaches occur. Uber said it was obligated to report the hack of driver’s license information and failed to do so.

“At the time of the incident, we took immediate steps to secure the data and shut down further unauthorized access by the individuals,” Khosrowshahi said. “We also implemented security measures to restrict access to and strengthen controls on our cloud-based storage accounts.”

Flouting regulations

Uber has earned a reputation for flouting regulations in areas where it has operated since its founding in 2009. The U.S. has opened at least five criminal probes into possible bribes, illicit software, questionable pricing schemes and theft of a competitor’s intellectual property. San Francisco-based Uber also faces dozens of civil suits. London and other governments have taken steps toward banning the service, citing what they say is reckless behavior by Uber.

In January 2016, the New York attorney general fined Uber $20,000 for failing to promptly disclose an earlier data breach in 2014. After last year’s cyberattack, the company was negotiating with the FTC on a privacy settlement even as it haggled with the hackers on containing the breach. The company finally agreed to the FTC settlement three months ago, without admitting wrongdoing and before telling the agency about last year’s attack.

The new CEO said his goal is to change Uber’s ways. Uber said it informed New York’s attorney general and the FTC about the October 2016 hack for the first time on Tuesday. Khosrowshahi asked for the resignation of Sullivan and fired Craig Clark, a senior lawyer who reported to Sullivan. The men didn’t immediately respond to requests for comment.

Khosrowshahi said in his emailed statement: “While I can’t erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes.”

The company said its investigation found that Salle Yoo, the outgoing chief legal officer who has been scrutinized for her responses to other matters, hadn’t been told about the incident. Her replacement, Tony West, will start at Uber on Wednesday and has been briefed on the cyberattack.

Kalanick was ousted as CEO in June under pressure from investors, who said he put the company at legal risk. He remains on the board and recently filled two seats he controlled.

Uber said it has hired Matt Olsen, a former general counsel at the National Security Agency and director of the National Counterterrorism Center, as an adviser. He will help the company restructure its security teams. Uber hired Mandiant, a cybersecurity firm owned by FireEye Inc., to investigate the hack.

The company plans to release a statement to customers saying it has seen “no evidence of fraud or misuse tied to the incident.” Uber said it will provide drivers whose licenses were compromised with free credit protection monitoring and identity theft protection.

[kscarbel2]

Massive leak exposes data on 123 million US households

Steven Musil, C/Net  /  December 19, 2017

The door to your personal data got left wide open once again.

Researchers revealed Tuesday that earlier this year they discovered a massive database -- containing information on more than 123 million American households -- that was sitting unsecured on the internet.

The cloud-based data repository from marketing analytics company Alteryx exposed a wide range of personal details about virtually every American household, according to researchers at cybersecurity company UpGuard. The leak put consumers at risk for a range of nefarious activities, from spamming to identity theft, the researchers warned.

No names were exposed, but the data set included 248 different data fields covering a wide variety of specific personal information, including address, age, gender, education, occupation and marital status. Other fields included mortgage and financial information, phone numbers and the number of children in the household.

"From home addresses and contact information, to mortgage ownership and financial histories, to very specific analysis of purchasing behavior, the exposed data constitutes a remarkably invasive glimpse into the lives of American consumers," UpGuard researchers Chris Vickery and Dan O'Sullivan wrote in their analysis.

A cascade of recent database breaches has left consumers on edge about the security of their personal information. After credit monitoring company Equifax revealed in September that cybercriminals had made off with data on more than 145 million Americans, US lawmakers began efforts [not really] to hold such businesses accountable to the everyday people whose data they collect for profit.

The Alteryx database was discovered in October in a misconfigured Amazon Web Services S3 cloud storage "bucket," the researchers said, allowing access to anyone with an easily obtainable account.

The repository contained massive data sets belonging to Alteryx partner Experian, a consumer credit reporting agency that competes with Equifax, and the US Census Bureau, researchers said. Alteryx apparently purchased the data from Experian's ConsumerView marketing database, a product sold to other companies that contains a combination of publicly available information and more personal data.

Neither Alteryx nor Experian responded to a request for comment. In a statement to Forbes, Alteryx said the database had been secured, and it downplayed the leak's severity.

"Specifically, this file held marketing data, including aggregated and de-identified information based on models and estimations provided by a third-party content provider, and was made available to our customers who purchased and used this data for analytic purposes," Alteryx said. "The information in the file does not pose a risk of identity theft to any consumers."

Experian struck a similar note in response to Forbes' query about the leak.

"This is an Alteryx issue, and does not involve any Experian systems," a spokesperson said. "Alteryx has already confirmed with you that the data in question contained no names of any individuals or any other personal identifying information, and does not pose any risk of identity theft to any consumers. We have been assured by Alteryx that they promptly remedied this issue."

The UpGuard researchers disagreed with that assessment.

"The data exposed in this bucket would be invaluable for unscrupulous marketers, spammers and identity thieves, for whom this data would be largely reliable and, more importantly, varied," the researchers said. "With a large database of potential victims to survey -- with such details as 'mortgage ownership' revealed, a common security verification question -- the price could be far higher than merely bad publicity."