FBI can Remotely Activate your Android Phone and Laptop's Mic, Cameras: Report

• Subscribe to PCF Networked Blog Daily Updates 
• Subscribe to our Twitter / Google / Yahoo Daily Updates

It wasn’t long ago when whole world was shocked at the revelation that NSA (National Security Agency) and FBI of United States of America has direct access to the servers of Google, Facebook, Microsoft, Skype, Yahoo, Apple and other internet companies, from where they can extract any user information at their will, without any authorization or approval required from justice and legal departments.

Situation has only worsen with this new finding that FBI can remotely activate the microphones and cameras of your smartphones running Google’s Android platform and laptops without users’ consent, reported WSJ.

Report said that FBI has been developing such hacking and surveillance tools for last ten years. Additionally, there are private firms which sell them such tools to spy the users. Without a doubt – as unveiled earlier – FBI has support from technology companies, such as Google, Microsoft, Apple and others.

Moreover, FBI uses spyware tools to record keystrokes or almost any activity on a computer or smartphone.

Report says that there are usually warrants required to undergo such surveillance on suspects, however, it argues that there were instances when FBI had recorded users’ data without any legal authorization.

With plenty of criticism about NSA’s PRISM program, this new hacking and spying practices from US law enforcement agencies are going to further hike the distrust level of technology users.

It merits mentioning here that there are over 900 million users with Android devices.
These revelations also raise serious questions about the privacy of individuals, which is seemingly brutally murdered by American government and agencies and buried hundreds of miles down under the turf.

Third world citizens are in desperate position, who had embraced these emerging technology gadgets and software for simplifying their lives, but ended up only to be watched by the American government.

Our own government, which can question American government about such shameless practices, is busy doing so many other use-less things.

Pakistan Cyber Force

Follow PCF on Facebook

Follow PCF on Twitter

Secret app caught spying on millions of Android, Apple, Nokia, BlackBerry Phones

• Subscribe to our Daily Updates via Networked Blog
• Subscribe to our Twitter/Google/Yahoo Daily Updates

The software secretly installed on millions of cell-phones is spying on users, reading their text messages and monitoring every keystroke, according to a mobile applications developer, who has published evidence online. ­Trevor Eckhart, 25, an Android app developer from Connecticut, has published what he says is conclusive proof that millions of smartphones are secretly monitoring keystrokes.  The video he posted on YouTube shows how a software package from a Silicon Valley company known as Carrier IQ reads private text messages and online search requests, records keystrokes and sends the information back somewhere, presumably the company.

Watch video of Eckhart explaining his findings:

“Every button you press in the dialer before you call”, Eckhart says, “it already gets sent off to the IQ application.” 

In his 17-minute video, Trevor shows his phone connected to a computer, explaining step-by-step his revelations. Though the software is installed on most modern Android, BlackBerry and Nokia phones, Carrier IQ was virtually unknown until Eckhart analyzed its workings. However, the company denies that its software is designed to spy on users. Carrier IQ earlier tried to suppress Eckhart's report. The video was published four days after Carrier IQ called off its threats of legal action and claims of monetary damages. Earlier Trevor Eckhart raised the ire of a company by labeling the software a “rootkit”. He said that the description suited the software well because, he says, it is made the way so that it hides its presence, avoiding operating system’s typical functions.

The Electronic Freedom Foundation, an activist group which promotes free speech online, supported Eckhart, and the Carrier IQ was forced to back off on its threats.

(RT.COM)

Related: Android Phones spying on users - How to Tame & Disarm this electronic spy before using

Enticing Fury

Pakistan Cyber Force

Follow PCF on Facebook

Follow PCF on Twitter

Android Phones spying on users - How to Tame & Disarm this electronic spy before using

• Subscribe to our Daily Updates via Networked Blog
• Subscribe to our Twitter/Google/Yahoo Daily Updates

Have you got an Android Phone and installed apps from the Android Market? Well guess what, you just blew your cover to Google which is CIA's information gathering tool on the cyber world, and its information stealing partners. Most of the mainstream Android Apps as well as the operating system itself are spying on you. Most of the stock apps installed in your new Android phone silently talk on the web without you even knowing about it and all of them have full access to your private data including your location, text messages, contacts and even the data you have stored on your external storage including the SD card of the phone.

For example, take a look at the permissions granted by default to these apparently innocent and helpful looking stock apps which include the stock Youtube app, the Dialer app, and the My Files (the stock file browser) app.

Youtube App(left), Phone(middle), My Files(right)

This clearly shows that when you connect to internet, these apps can automatically upload all the data that they want to Google's servers. Why on earth would a File Browser require details of your contacts, google mail as well as the phone state and identity? And above everything, when it doesn't have the functionality to connect to remote machines, why on earth does it require full internet access?

Let me bring to your notice another beautiful trap laid by the information thieves behind Android. Just like Apple's popular app Siri (the talking assistant), many promising looking apps have started popping up on the android market and most of them use Google's own Text To Speech (TTS) service. This service takes a sample of your voice, uploads it to the internet to Google's servers, and brings back the text which was said in that voice message. How safe is that? And let me ask you a question, how wise is it to let such services run wildly and freely on your phone when you are having a personal discussion with a group of your old friends after a late night dinner? But its there, and its running without your knowing in the background.

Let me give you a bigger shock. These are the visible apps, whereas being a powerful multi-threaded environment, your Android phone has dozens of daemons (processes with no user interface, in other words ghost processes) running in the background which you don't even know or care about. And all those hidden thieves are talking on the web sending whatever data they want, anonymously to remote servers without your consent. For example, the Kernel of your phone.

On my test phones running Android, in Pakistan, this little thief was found talking to the following IP addresses secretly. I was not able to log the packets for a detailed dissection however you can try it on your own if you want to.

• 173.192.219.151
• 119.73.37.46
• 50.19.53.41

For those of you who are interested in digging deeper into it, you can visit this website to backtrace these IP addresses, and others that you find out on your phone after you go through this tutorial, to find out exactly who is listening to you secretly over the web.

This is not all, I have not found anywhere on internet exactly how could one disarm this dirty little spy i.e., your Android phone that resides in your pocket, around your workplace and near your family all the time, informing Google, the CIA's partner in information stealth crime. And what's worse, there are thousands of free apps available in the Android Market whose developers have given shady details about their technological and corporate background, which are having complete access to absolutely every feature of your phone without your consent. At the end of this article, we shall use brute force method to disarm your pocket spy ensuring your personal information safety. Let us first share a brief study done by Duke University, Penn State and Intel Research Labs regarding this matter here.

Quote from PC World Website:

<-------------------------- Quote --------------------------->

Even if you never use services like Foursquare or Facebook Places or Google Latitude to announce your physical location to the world, the apps you have installed may be capturing this information and sharing it with advertisers -- without your knowledge or consent.

A study by researchers at Duke University, Penn State, and Intel Research Labs has revealed that Android apps are collecting location information from users' GPS phones and sharing them without notifying users or asking for permission.

The researchers looked at 30 popular Android apps, including The Weather Channel, MySpace, Evernote, BBC News Live Stream, Yellow Pages, and Spongebob Slide. They used a home-made tool called TaintDroid to track what data was being shared and with whom. The skinny:

• Two thirds of these apps violated user privacy by sharing location data or information that could identify individual handsets.
• Half of them sent user location information to advertising networks like Admob or analytics companies like Flurry without user consent.
• Seven of the apps sent the unique device identification numbers of the GSM user and the handsets' SIM card to its servers.
• Two of the apps captured the users' cell phone number along with the ID number and the users' geographical coordinates.

Nice.
Mind you, if the police wanted this information, they'd need a court order. These apps are doling it out like candy to advertising firms and storing it on their own servers. Per the study [PDF]:
This finding demonstrates that Android's coarse-grained access control provides insufficient protection against third-party applications seeking to collect sensitive data. Moreover, we found that one application transmits the phone information every time the phone boots. While this application displays a terms of use on first use, the terms of use does not specify collection of this highly sensitive data.
The study did not name which applications shared each kind of information -- a shame, really, because the ones that did not are tarred with the same brush as the guilty ones. Me, I'd uninstall all of them, just to be safe.
Here's the full list of apps tested, both guilty and innocent:

The Weather Channel, Cestos, Solitaire, Movies, Babble, Manga Browser, Bump, Wertago, Antivirus, ABC Animals, Traffic Jam, Hearts, Blackjack, Horoscope, 3001 Wisdom Quotes Live, Yellow Pages, Dastelefonbuch, Astrid, BBC News Live Stream, Ringtones, Layer, Knocking, Barcode Scanner, Coupons, Trapster, Spongebob Slide, ProBasketBall, MySpace, ixMAT, and Evernote.

I've written before about why location privacy is important and how your location data is mostly up for grabs. But the reality is proving far worse than even I imagined. Simply by installing an app, you could be transmitting a stream of data indicating where you are 24/7 that isn't protected by any law yet on the books.
While this study was limited to Android apps, the problem is not. I expect to hear a lot more about other apps slurping up GPS and handset information, either accidentally or deliberately, on other handset platforms. The reason we're hearing about Android first is that Android is open source and easier for researchers to access.
It seems the location chickens are coming home to roost. Let's hope you don't end up with egg all over you.

<------------------------- Unquote -------------------------->

Don't be deceived by the sleak looks of these electronic spies. Make sure to clean them before you plan to use one of these!

Let's do some cleaning!
Nobody likes being spied upon. So here we present to you a brute force method of kicking out the apps that a normal phone user never actually needs on his phone in the first place. We shall proceed step-by-step. However, before we start, you need a few apps installed on your Android phone before proceeding further.

1: First of all, you have to root your phone. Ignore all the hype that it voids warranty because it doesn't, and even if it does, you can flash your phone with clean firmware before you plan to sale it forward, so it really doesn't matter in the first place. There are several methods available for rooting dozens of Android phones which are available, so you will just have to dig into this part yourself. Once rooted, a little app named SuperUser will be installed on your phone granting you explore the prohibited areas of your device.

2: After successful root, you need to install Root Explorer, or any other good file browser that lets you explore through the root directory ( /System ) on your phone.

3: There are a whole lot of system stock apps which come pre-installed and you normally don't need them on your phone. Most of them are severe spies which not only spy on you but also sync your personal information including contacts, messages and more on a completely untrustworthy Google server under the pretext of "sync with your mail account". The test phone which we examined is the most widely sold Android device in Pakistan, the Samsung Galaxy Ace. After you have rooted the phone and have access to /system/app, all you need to do is to rename these apps so that the OS can no longer access them and you can rename them back to original just in case you run into any operational problems.

• AccountAndSyncSettings.apk
• AccountAndSyncSettings.odex
• ApplicationsProvider.apk
• ApplicationsProvider.odex
• BadgeProvider.apk
• BadgeProvider.odex
• DataCreate.apk
• DataCreate.odex
• Dlna.apk
• Dlna.odex
• Email.apk
• Email.odex
• GenieWidget.apk
• Gmail.apk
• GoogleBackupTransport.apk
• GoogleCalendarSyncAdapter.apk
• GoogleContactsSyncAdapter.apk
• GoogleFeedback.apk
• GooglePartnerSetup.apk
• GoogleQuickSearchBox.apk
• MediaUploader.apk
• MusicHub_U1.apk
• PicoTts.apk
• PicoTts.odex
• SamsungApps.apk
• SamsungAppsUNA3.apk
• SecDownloadProvider.apk
• SecDownloadProvider.odex
• SerialNumberLabelIndicator.apk
• SerialNumberLabelIndicator.odex
• signin.apk
• signin.odex
• SisoDrmProvider.apk
• SisoDrmProvider.odex
• SnsAccount.apk
• SnsAccount.odex
• SnsProvider.apk
• SnsProvider.odex
• syncmldm.apk
• syncmldm.odex
• Talk.apk
• Talkback.apk
• TtsService.apk
• TtsService.odex
• UnifiedInbox.apk
• UnifiedInbox.odex
• VoiceSearch.apk
• wssomacp.apk
• wssomacp.odex
• wssyncmlnps.apk
• wssyncmlnps.odex

4: These are those stock apps which a normal phone user seldom uses. For checking e-mail, there are several browsers and credible third party open-source apps available for checking mail remotely. Now, all you have to do is add .bak at the end of the file names of each and everyone of these apk and odex files using Root Explorer on your rooted phone(make sure to hit the Read/Write privilege button at the top right in case of Root Explorer). Your phone could momentarily hang up as these processes crash in the memory, and in some cases it can even reboot. But don't worry, this is normal.

After getting done with it, turn off your phone. Then hold its home button + Power button to bring it to debug mode. Once there, you should select "Clear Cache Partition" option and then reboot for a clean startup. If you, however intend to rename any other apps besides the list mentioned above, and upon reboot your phone is not functioning properly, you can go back to /system/app and rename those apps back to normal one by one to trace the problem and reboot. It's a hit-and-trial procedure on various phones. Just get rid of everything that you don't require as long as your phone is working fine. Even if your phone doesn't start up properly after making changes to apps that you just discarded, in the worst case all you could have to do is to reprogram your phone's firmware but with smart phones, its extremely easy to do it. I flash my phone's firmware every couple of weeks, no big deal really. Dozens of guides are available for almost all main Android cellphones online, so you'll have to do a bit of digging for that.

5: After you have done this and more if you see fit, test your phone for a few hours to ensure that it is functioning properly. Once you are sure, note down the names of all the apps you renamed, and now you can safely delete them permanently from your phone. However if your phone has enough internal memory, leaving them intact is a good decision so that you can bring an app back just in case, something goes wrong and you know due to which app it happened.

6: There is a free app available named AutoStarts (download apk here) which once installed on a rooted phone, gives you access to disable automatic startup events for individual applications, both stock as well as third party apps. Once you clean your phone from useless services and spies, this application is useful for keeping services from auto-starting which automatically start and start their spying, for example, the stock Google Maps application. I found it permanently running on a brand new phone and no matter what one would do, this app would simply not stay killed even after a FORCE SHUTDOWN from settings app. But using this app Autostarts, I was able to disable its autostart events. You will find this app really handy not only in keeping the obvious spies asleep unless you badly need them, but also it will help you in speeding up your phone manifold since useless apps will be prevented from starting up automatically in the background when you don't need them.

7: Install an app named DroidWall which is a full featured firewall for your phone, or any other firewall app of your choice and trust. DroidWall is available for free download in Android Market. Once installed, use this app to deny internet access to all apps whom you DO NOT WANT to access the internet in the first place. Especially, the GPS service. I don't know about you but I don't want my GPS coordinates to be reported on the internet because I don't trust what information GPS service is sending over the internet. As you can see in the screenshot on the right, I have blocked internet access to each and everyone of these process and more, that are listed with grey check-boxes on the right left side of app names. You can use this app to fully control as well as log your phone's internet traffic activities.

8: Now onto a more serious issue. Do you know that Android Market app itself is spying upon you? Yes it is, and perhaps more seriously than any other apps because it records absolutely all app records which you are using. What's even worse, the initial agreement which you sign by pressing "Accept" button before using the Android Market states that Google possesses the right to remotely uninstall any app it wants from your phone, without your consent. Surprised? It needs your gmail account to be linked to your market so if you use your gmail address for e-mail purpose, you are trapped. But unfortunately you have to use it everytime you need an app. Don't worry, we can take care of this as well. All you have to do is to make a fake gmail account, and link it to your android mobile phone, so that your e-mails cannot be linked to your cyber activities. A better way to avoid this nuisance is to cut all the android market files from your phone when you are not using market, and paste them in a separate folder on your SD card. You can just move them back momentarily to /System/App whenever you need to access the market. Here is a list of all those apps in /System/App that are basically making up the Android Market app.

1. DownloadProvider.apk
2. DownloadProvider.odex
3. DownloadProviderUi.apk
4. DownloadProviderUi.odex
5. DrmProvider.apk
6. DrmProvider.odex
7. DrmUA.apk
8. DrmUA.odex
9. GoogleServicesFramework.apk
10. MarketUpdater.apk
11. Vending.apk

Do your research about the apps you want, using your computer's internet, note them down and install them in one go. After getting done, simply cut all the above mentioned files from /System/app of your phone and paste them somewhere on your SD card or in a .zip file. Now Android Market is temporarily gone from your phone and it can no longer keep track of your apps. Whenever in future, you want it back momentarily, you can put all these files back, sign into your fake gmail account using from market and you're good to go again. However, a reboot will be required every time you move these files in most cases.

General safety precautions: 

1. Never use any Text-To-Speech related apps as long as they are using Google's TTS service at their back-end (it is always mentioned in the app description on Android Market that what stock apps it makes use of). We don't want anyone sitting thousands of miles away from us, to listen to our conversations just for the sake of sending us back its text.
2. Don't ever allow GPS service and all other apps that have no business on internet, to access the web. Always have a firewall in place and running BEFORE you connect to the internet.
3. Don't let the market and other stock apps access internet freely all the time when you are actually not doing any internet activity. Make use of the firewall or brute force method as explained above, to take care of your privacy business with your own hands.
4. Always check and investigate the trustworthiness of the developer of a particular app which your phone is running, before you allow it to have complete internet access. Usually contact e-mail addresses of the developers are mentioned in the Android Market, so its a good idea to contact the developer directly.
5. Try to use as many trustworthy third party apps as you can, replacing the stock apps.
6. High end users, it's always a good idea to place a packet logger in place too, which can sniff all the internet traffic so that you can monitor which crooked little thief is stealing what. Andro Shark is a good app out there in the market however there are many that do the job. It's upto you to make your own choice.

With this, I can say that your phone is comparatively much more secure than it was when you bought it brand new from the market. Let your friends know about this information too who you know are using Android phones / tablets. Even Apple and other mainstream products are doing pretty much the same with your privacy, but we shall target others at a later time.

Please send your suggestions, questions and additional queries in the comments below. (Related: What is Traitorware? Technology that spies on you)

Written by Enticing Fury

Pakistan Cyber Force

Follow PCF on Facebook

Follow PCF on Twitter

Adobe Flash Player slammed for spying

Read on Pakistan Cyber Force Facebook Page

• Subscribe to PCF Networked Blog Daily Updates
• Subscribe to our Twitter/Google/Yahoo Daily Updates

Local Shared Objects, LSO, commonly called Flash cookies are collections of cookie-like data stored as a file on a user computer. Used by Flash-based applications to store preferences, cache files or save state and temp data, all methods of improving user experience. The sole purpose of this technology is to trace user movements around the Internet and it has the ability to store a lot of information about you, which is around 100 Kilobyte for each cookie whereas, normal HTTP cookies can store only about 4 Kilobyte. The bad news is that you can't locate them in your browser. They are not shown in the list of cookies that you can see when you take a look at the cookies that are currently saved in your web browser. All use them employ Web ad companies like Quantcast, Specificmedia, and Clearspring to deliver Flash ads, and all of those ads store Flash cookies on your hard drive. The bizarre thing is that they can be used to recreate tracking cookies you've deleted.

Adobe Flash Player

In other words, if you've told an advertiser you don't want to be followed around the Web by deleting its tracking cookie, that advertiser can use Flash to reproduce that deleted cookie and continue to track you in secret. This clearly breaks international laws against computer intrusion and surveillance for which several famous companies have been alleged including Disney, Warner Bros. Records, Ustream, Youtube, Google Videos, Columbia Pictures,  and others. They have installed illegal codes on millions of computers with the purpose of tracking the online activity of its users.

This is exactly what the companies referred to collectively as "Clearspring Flash Cookie Affiliates". The defendants are Clearspring Technologies, the company developing Flash-based technologies and its customers, which include Walt Disney Internet Group, Demand Media, Project Playlist, Soapnet, SodaHead, Ustream and Warner Bros. Records. The complaint read, "Defendants Clearspring Flash Cookie Affiliates acted with Defendant Clearspring, independently of one another, and hacked the computers of millions of consumers' computers to plant rogue, cookie-like tracking code on users' computers. With this tracking code, Defendants circumvented users' browser controls for managing web privacy and security."

According to the complaint, the collected information could have been used to determine "users' video viewing choices and personal characteristics such as gender, age, race, number of children, education level, geographic location, and household income, what the web user looked at and what he/she bought, the materials he/she read, details about his/her financial situation, his/her name, home address, e-mail address and telephone number, and even more specific information like health conditions, such as depression." The company developing Flash, has condemned the practice of using Local Storage for backing up or restoring cookies without express user consent.

Getting rid of the perilous danger

You just need to use “Adobe's Flash Player Settings Manager”. The Website Storage Settings display all Flash cookies that are currently saved on your computer. You can delete flash cookies from individual sites or all at once.

It is also possible to increase or decrease the Kilobyte size of all information that are stored on your computer. No Flash Cookies will be saved if you go into Global Storage Settings and disable the option “Allow third-party Flash content to store data on your computer”. Just follow the instructions and you're good to go.

Surf the internet safely.

Written by: Sarah Ssmq

Edited by: Enticing Fury

Pakistan Cyber Force

What is Traitorware? - Technology that secretly spies on you

• Subscribe to our Daily Updates via Networked Blog
• Subscribe to our Twitter/Google/Yahoo Daily Updates

Your digital camera may embed metadata into photographs with the camera's serial number or your location. Your printer may be incorporating a secret code on every page it prints which could be used to identify the printer and potentially the person who used it. Your web browser may report your Internet surfing information to some ghost remote machine without your notice, stealing your usernames / passwords to spy on you through automated bots. If Apple puts a particularly creepy patent it has recently applied for into use, you can look forward to a day when your iPhone may record your voice, take a picture of your location, record your heartbeat, and send that information back to the mothership. This is traitorware: devices that act behind your back to betray your privacy.

Perhaps the most notable example of traitorware was the Sony rootkit. In 2005 Sony BMG produced CD's which clandestinely installed a rootkit onto PC's that provided administrative-level access to the users' computer. The copy-protected music CD’s would surreptitiously install its DRM technology onto PC’s. Ostensibly, Sony was trying prevent consumers from making multiple copies of their CD’s, but the software also rendered the CD incompatible with many CD-ROM players in PC’s, CD players in cars, and DVD players. Additionally, the software left a back door open on all infected PC’s which would give Sony, or any hacker familiar with the rootkit, control over the PC. And if a consumer should have the temerity to find the rootkit and try to remove the offending drivers, the software would execute code designed to disable the CD drive and trash the PC.

Traitorware is sometimes included in products with less obviously malicious intent. Printer dots were added to certain color laser printers as a forensics tool for law enforcement, where it could help authenticate documents or identify forgeries. Apple’s scary-sounding patent for the iPhone is meant to help locate and disable the phone if it is lost or stolen. Don’t let these good intentions fool you! Software that hides itself from you while it gives your personal data away to a third party is dangerous and dishonest. As the Sony BMG rootkit demonstrates, it may even leave your device wide open to attacks from third parties.

The most recent example of traitorware is Google's famous browser Chrome that keeps on "updating" even when the browser is up-to-date. It installs a separate updater service on the client computer which remains active even when the browser is not open. And interestingly, you will never find this cute little updater service silent on the network! As it was exposed by a well known TV anchor Alex Jones, Google has been affiliated with CIA and NSA(National Security Agency) for the last many years and they are providing their "services" worldwide free of cost just for the sake of keeping an eye on everyone. This is the only reason why China blasted Google and banned its website network as well as its products inside China. But outside China, Google is running wild with its Online Office and other "handy" tools and violating its users' privacy.

There are several such applications even built into some of the most commonly used operating systems such as Microsoft Windows, which claim to "report user experience to the company for improvement of product and services" but behind the scene, the user's privacy is completely compromised. Traitorware is not some science-fiction vision of the future. It is the present. Indeed, the Sony rootkit dates back to 2005. Apple’s patent application indicates that we are likely to see more traitorware on the horizon. When that happens, EFF will be there to fight it. We believe that your software and devices should not be a tool for gathering your personal data without your explicit consent. As a safety measure, always DISCONNECT your computer from internet while working on sensitive data and it would be even better if you use an external storage device for your critical private data to ensure privacy.

Enticing Fury
Pakistan Cyber Force

Follow PCF on Facebook

Follow PCF on Twitter