#1yrago Stingray for criminals: spreading mobile malware with fake cellphone towers

Uncategorized

mostlysignssomeportents:

Police who rely on vulnerabilities in crooks’ devices are terminally
compromised; the best way to protect crime-victims is to publicize and
repair defects in systems, but every time a hole is patched, the cops
lose a tool they rely on the attack their own adversaries.

Case in point: fake cellphone towers.

By design, cellphones mistrust their owners. Owners are not supposed to
be able to see, control or alter the low-level communications their
phones undertake with towers, lest they figure out how to avoid being
billed for their calls and data use, or even attack other phones
connected to the same tower.

This means that attacks against these low-level systems are extremely
hard for phone owners to detect or prevent, which is why law enforcement
has become so reliant on fake cell towers (called “dirtboxes,” “stingrays” or “IMSI catchers”) to spy on cellphone users and even inject malicious data into their streams.

Because this attack works best when the victim doesn’t know it’s
possible, cops and prosecutors went to crazy lengths to keep it secret: lying to judges, raiding local police forces to steal their records, engaging in bulk-redaction of records – only to be outed by an obsessive jailhouse lawyer.

But security flaws in cellphones don’t just make criminals vulnerable to attacks from cops: they leave everyone vulnerable to attacks on their phones.

Case in point: Swearing Trojan.

Swearing Trojan (named for the Chinese curse words sprinkled in its
sourcecode) is a piece of mobile malware used to defeat 2-factor
authentication systems like those that protect banking logins and
corporate networks. By hiding in the phone, it is able to steal 2-factor
messages and convey them to criminals at login time.

Swearing Trojan’s author is in jail, but the malware lives on, and one
of its most effective tools for spreading itself is through fake
messages sent from fake cellphone towers – towers that are
indistinguishable from real ones to victims’ phones, because police have
spent the past five years exploiting fake cellphone towers, rather than
trying to get manufacturers to make them impossible.

Fake cellphone towers are easy and cheap to make, and they’re
devastatingly effective. Your phone could be connected to one right now
and you’d never know. Think of all the data your phone protects –
especially when it comes to two-factor authentication. That’s the data
that the security services have decided to sacrifice to make their jobs
easier.

https://boingboing.net/2017/03/29/democratizing-crime.html

Help crowdfund the Harlem Cryptoparty and 100 unlimited, privacy-protecting wifi hotspots for Puerto Rico

Uncategorized

mostlysignssomeportents:

Calyx is an amazing nonprofit, privacy-oriented activist ISP (they were the first ISP to successfully resist a secret Patriot Act warrant); they are notable for offering an unlimited, unfiltered, unthrottled 4G/wifi hotspot for a tax-deductible $400 year (mine has repeatedly saved my bacon).

Now, Calyx is trying to raise $100K in a charitable crowdfunder to
extend key privacy technologies to two marginalized groups: people
rebuilding Puerto Rico and privacy trainers with the Harlem Cryptoparty, who provide operational security advice for #blacklivesmatter activists and the wider, oversurveilled black community.

Calyx is planning to equip 100 public libraries in Puerto Rico with
unlimited bandwidth that can be loaned to patrons to take home, and to
continue its sponsorship of Harlem Cryptoparty for another year.

I just gave them $100.

https://boingboing.net/2018/03/29/privacy-by-design.html

#5yrsago Editorial board of Journal of Library Administration resigns en masse in honor of Aaron Swartz

Uncategorized

mostlysignssomeportents:

The entire editorial board of the Journal of Library Administration resigned en masse. Board member Chris Bourg wrote publicly about the decision, and an open letter elaborates
on it, stating that their difference of opinion with publisher Taylor
& Francis Group about open access, galvanized by Aaron Swartz’s
suicide, moved them to quit.

https://boingboing.net/2013/03/28/editorial-board-of-journal.html