spy & security

‘Knock, knock! Who’s there?’ —Shakespeare

38.jpg

The malware, called “Regin”, is probably run by a western intelligence agency and in some respects is more advanced in engineering terms than Stuxnet. […]

Symantec said it was not yet clear how Regin infected systems but it had been deployed against internet service providers and telecoms companies mainly in Russia and Saudi Arabia as well as Mexico, Ireland and Iran. […]

“Nothing else comes close to this . . . nothing else we look at compares,” said Orla Cox, director of security response at Symantec, who described Regin as one of the most “extraordinary” pieces of hacking software developed, and probably “months or years in the making”. […] “Sometimes there is virtually nothing left behind – no clues. Sometimes an infection can disappear completely almost as soon as you start looking at it, it’s gone. That shows you what you are dealing with.”

{ FT | Continue reading }

Mercury Retrograde in Gemini in your face

Yo, the app, has been hacked

‘Or, si l’habit ne fait pas le moine, l’habitation fait l’habitant.’ —Alexandre Dumas, fils

531.gif

In shopping malls, for instance, a firm called Euclid Analytics collects, in its own words, “the presence of the device, its signal strength, its manufacturer (Apple, Samsung, etc.), and a unique identifier known as its Media Access Control (MAC) address.” In London last year, one start-up installed a dozen recycling bins that sniffed MAC addresses from passers-by, effectively tracking people through the area via their phones. Such companies go to great lengths to explain that such information in not personally identifiable—except that repeated studies have shown that this data can indeed be used to infer a great deal about your life.

At the core of such tracking is the MAC address, a unique identification number tied to each device. Devices looking for a Wi-Fi network send out their MAC address to identify themselves. Wireless routers receive the signals—and addresses—even if a connection is never made. Companies like Euclid or its peer Turnstyle Solutions use the data to track footfall in stores, how people move about in shops, how long they linger in certain sections, and how often they return. Store-owners use the information to target shoppers with offers (paywall) or to move high-value items to highly-trafficked parts of the shop, among other things. […]

Apple’s solution, as discovered by a Swiss programmer, is for iOS 8, the new operating system for iPhones which will be out later this year, to generate a random MAC addresses while scanning for networks. That means that companies and agencies that collect such information will not necessarily know when the same device (i.e., person) visits a store twice, or that the same device pops up in stores across the country or the world, suggesting a much-travelled owner.

{ Quartz | Continue reading }

related { With the launch of a health app and data-sharing platform, Apple is betting that tracking your vital signs via smartphone is about to become a booming industry }

‘Funeral by funeral, theory advances.’ –Paul Samuelson

231.jpg

Over the past year, I’ve spent a great deal of time trolling a variety of underground stores that sell “dumps” — street slang for stolen credit card data that buyers can use to counterfeit new cards and go shopping in big-box stores for high-dollar merchandise that can be resold quickly for cash. By way of explaining this bizarro world, this post takes the reader on a tour of a rather exclusive and professional dumps shop that caters to professional thieves, high-volume buyers and organized crime gangs. […]

Like many other dumps shops, McDumpals recently began requiring potential new customers to pay a deposit (~$100) via Bitcoin before being allowed to view the goods for sale. Also typical of most card shops, this store’s home page features the latest news about new batches of stolen cards that have just been added, as well as price reductions on older batches of cards that are less reliable as instruments of fraud. […]

People often ask if I worry about shopping online. These days, I worry more about shopping in main street stores. McDumpals is just one dumps shop, and it adds many new bases each week. There are dozens of card shops just like this one in the underground (some more exclusive than others), all selling bases [batches of cards] from unique, compromised merchants.

{ Krebs on Security | Continue reading }

Full of win

354.jpg

Today, credit cards are on supersale. Pageler says that means a big breach just happened.

Strangely, platinum credit cards on the site are selling for less money than gold cards. […]

The bots send out emails, and between 5 percent and 10 percent of recipients open the attachment, which lets the crooks in.

{ NPR | Continue reading }

On a day of the week with a y in it

He booted up a smartphone in a Moscow café and watched as unidentified attackers immediately began to cyber-assault it.

{ Slashdot | Continue reading }

In the idle darkness comes the bite

323.jpg

{ When a shopper enters Reebok’s flagship store in New York City, a face-detection system analyzes 10 to 20 frames per second to build a profile of the potential customer. The algorithms can determine a shopper’s gender and age range as well as behavioral and emotional cues, such as interest in a given display (it tracks glances and the amount of time spent standing in one place). Reebok installed the system, called Cara, in May 2013; other companies are following suit. Tesco recently unveiled a technology in the U.K. that triggers digital ads at gas stations tailored to the viewer’s age and gender. | Popular Science | full story }

Ivan Ilych saw that he was dying, and he was in continual despair

52.jpg

People whose cellphones move at a certain clip across city parks between 5:30 and 8:30 every morning are flagged by Viasense’s algorithm as “early morning joggers.” When you give your smartphone permission to access your location, you may be sharing a lot more than you realize.

{ WSJ | Continue reading }

We show that easily accessible digital records of behavior, Facebook Likes, can be used to automatically and accurately predict a range of highly sensitive personal attributes including: sexual orientation, ethnicity, religious and political views, personality traits, intelligence, happiness, use of addictive substances, parental separation, age, and gender. […]

Table S1 presents a sample of highly predictive Likes related to each of the attributes. For example, the best predictors of high intelligence include “Thunderstorms,” “The Colbert Report,” “Science,” and “Curly Fries,” whereas low intelligence was indicated by “Sephora,” “I Love Being A Mom,” “Harley Davidson,” and “Lady Antebellum.” Good predictors of male homosexuality included “No H8 Campaign,” “Mac Cosmetics,” and “Wicked The Musical,” whereas strong predictors of male heterosexuality included “Wu-Tang Clan,” “Shaq,” and “Being Confused After Waking Up From Naps.” Although some of the Likes clearly relate to their predicted attribute, as in the case of No H8 Campaign and homosexuality, other pairs are more elusive; there is no obvious connection between Curly Fries and high intelligence.

Moreover, note that few users were associated with Likes explicitly revealing their attributes. For example, less than 5% of users labeled as gay were connected with explicitly gay groups, such as No H8 Campaign, “Being Gay,” “Gay Marriage,” “I love Being Gay,” “We Didn’t Choose To Be Gay We Were Chosen.” […]

Predicting users’ individual attributes and preferences can be used to improve numerous products and services. For instance, digital systems and devices (such as online stores or cars) could be designed to adjust their behavior to best fit each user’s inferred profile. Also, the relevance of marketing and product recommendations could be improved by adding psychological dimensions to current user models. For example, online insurance advertisements might emphasize security when facing emotionally unstable (neurotic) users but stress potential threats when dealing with emotionally stable ones.

{ PNAS | PDF }

related { PhD candidate in sociology explains his experiences working for Facebook }

photo { Albert Moldvay, A woman shops for a fur coat at Bergdorf Goodman in New York City, 1964 }

‘Repression is the only lasting philosophy.’ –Charles Dickens

43.jpg

American and British spies have infiltrated the fantasy worlds of World of Warcraft and Second Life… […] The spies have created make-believe characters to snoop and to try to recruit informers, while also collecting data and contents of communications between players. […]

By the end of 2008, according to one document, the British spy agency, known as GCHQ, had set up its “first operational deployment into Second Life” and had helped the police in London in cracking down on a crime ring that had moved into virtual worlds to sell stolen credit card information. […]

Even before the American government began spying in virtual worlds, the Pentagon had identified the potential intelligence value of video games. The Pentagon’s Special Operations Command in 2006 and 2007 worked with several foreign companies — including an obscure digital media business based in Prague — to build games that could be downloaded to mobile phones, according to people involved in the effort. They said the games, which were not identified as creations of the Pentagon, were then used as vehicles for intelligence agencies to collect information about the users.

{ ProPublica | Continue reading }

related { A Single Exposure to the American Flag Shifts Support Toward Republicanism up to 8 Months Later }

What would you do if you were not afraid?

35.jpg

{ FBI can secretly turn on laptop cameras without the indicator light. }

photo { Daniel Ehrenworth }

Stars — they’re just like us

316.jpg

{ How Much is Your Gmail Worth to Attackers? | The Value of a Hacked Email Account }

three tommix, soldiers free, cockaleak and cappapee

310.jpg

The first thing I did after I heard about the highly classified NSA PRISM program two years ago was set up a proxy server in Peshawar to email me passages from Joyce’s Finnegans Wake.

{ John Sifton/Warscapes | Continue reading | Thanks Aaron }