bookmark_borderThe Danger in Email, Sytlesheets, Scripts and Session Replay

Membrane Domain Security Center

https://freedom-to-tinker.com/2017/09/28/i-never-signed-up-for-this-privacy-implications-of-email-tracking/

What happens when you open an email and allow it to display embedded images and pixels? You may expect the sender to learn that you’ve read the email, and which device you used to read it. But in a new paper we find that privacy risks of email tracking extend far beyond senders knowing when emails are viewed. Opening an email can trigger requests to tens of third parties, and many of these requests contain your email address. This allows those third parties to track you across the web and connect your online activities to your email address, rather than just to a pseudonymous cookie.

How it works. Email tracking is possible because modern graphical email clients allow rendering a subset of HTML. JavaScript is invariably stripped, but embedded images and stylesheets are allowed. These are downloaded and rendered by the email client when the user views the email.[2] Crucially, many email clients, and almost all web browsers, in the case of webmail, send third-party cookies with these requests. The email address is leaked by being encoded as a parameter into these third-party URLs.

https://freedom-to-tinker.com/2017/11/15/no-boundaries-exfiltration-of-personal-data-by-session-replay-scripts/

You may know that most websites have third-party analytics scripts that record which pages you visit and the searches you make. But lately, more and more sites use “session replay” scripts. These scripts record your keystrokes, mouse movements, and scrolling behavior, along with the entire contents of the pages you visit, and send them to third-party servers. Unlike typical analytics services that provide aggregate statistics, these scripts are intended for the recording and playback of individual browsing sessions, as if someone is looking over your shoulder.

https://motherboard.vice.com/en_us/article/59yexk/princeton-study-session-replay-scripts-tracking-you
Over 400 of the World’s Most Popular Websites Record Your Every Keystroke

Prominent companies who use the scripts include men’s retailer Bonobos.com, Walgreens.com, and the financial investment firm Fidelity.com. It’s also worth noting that 482 might be a low estimate. It’s likely that the scripts don’t record every user that visits a site, the researchers told me. So when they were testing, they likely did not detect some scripts because they were not activated. You can see all the popular websites that utilize session replay scripts documented by the researchers here.

The Walgreen’s example runs afoul of HIPPA in, oh, so many ways.

List of sites discovered (I bet many, many more are doing it)

https://webtransparency.cs.princeton.edu/no_boundaries/session_replay_sites.html

Disable all scripting. Disable images. Hell, I’m almost at the point of disabling stylesheets, that’ll be the next tracker if they aint doing it already.

I guess, just use surfraw and parse the output. Or go oldschool and lynx/links.

sidd

bookmark_borderNSA Hack Set Loose on World

by Daniel Brouse for The Membrane Doamin

It appears that malware hacked from the NSA in April 2017 has been set loose on the world. The massive ransomware infection hit at least 99 countries. The ransomware is called WannaCry. The source was leaked as part of the NSA spytools. The code was modified by hackers to takeover computers. Then, a ransom note says you must pay $300 in BitCoin to save your computer. The price increases every couple of hours if the ransom isn’t paid. The ransomware spreads by taking advantage of a vulnerability in Microsoft Windows. Microsoft issued a patch after the NSA leak; however, computers that did not apply the patch were at risk.

In the UK, 16 National Health Service organizations were taken off-line. Europol said the attack was of an “unprecedented level and requires international investigation.” Cybersecurity firm Avast said, “the majority of the attacks targeted Russia, Ukraine and Taiwan. But U.K. hospitals, Chinese universities and global firms like Fedex also reported they had come under assault.”

Later in the day, the “accidental hero” halted the global spread. The Guardian reported, “The researcher, who identified himself only as MalwareTech, is a 22-year-old from south-west England who lives with his parents and works for Kryptos logic, an LA-based threat intelligence company.”

“I was out having lunch with a friend and got back about 3pm and saw an influx of news articles about the NHS and various UK organizations being hit,” he said. “I had a bit of a look into that and then I found a sample of the malware behind it, and saw that it was connecting out to a specific domain, which was not registered. So I picked it up not knowing what it did at the time.”

The fake domain name was a “kill switch” in the malware. When the domain really showed up on the Internet, the virus stopped replicating. “The intent was to just monitor the spread and see if we could do anything about it later on. But we actually stopped the spread just by registering the domain,” he said. “This is not over. The attackers will realize how we stopped it, they’ll change the code and then they’ll start again. Enable windows update, update and then reboot.”

At the writing of this article it is estimated that 1/2 million pounds have already been paid in ransom.

bookmark_borderCyber Security Landscape

Q: Is it true that flashlight apps for your smartphone may contain malware?
A: It’s not just flashlight apps. Over 90% of freeware (free computer software for photos, converting Youtube videos, etc.) and free app downloads contain malware that is secretly added to your device. Besides stealing your data, they can corrupt files or worse. Quite often they use your connection and device to attack other people making it look like you are the bad guy. Attacks on the Whitehouse, FBI, CIA and military bases (such as Andrews Air Force Base) have happened this way. As far as smartphone apps go, there are not that many legit apps. Apple is of particular concern because their developer’s “tool kit” has been compromised. The result was many legit app developers used the official Apple tool kit, but ended up incorporating malware. This is what happened with most of the flashlight apps. (1)

By the way, the apps developed for Facebook are often used to compromise your Facebook account and steal your identity, as well as, attack all your friends. If Facebook doesn’t make the app, don’t use it. Examples of bogus apps include “What song was a hit on your birthday?”, “How loyal are you?”, “Who is stalking you?”, “Which season of the year are you?”, “3 reasons to love yourself!”, “Let’s make a drawing of you” and “Yourself as an oil painting”.

Q: How do I know if Facebook makes the app?
A: If Facebook makes the app, it is usually automatically integrated into the interface. Examples include when Facebook added more choices to the “like” button and the app they put in your feed about “1 year ago today”. Those are Facebook apps. The ones that tell you about your loyalty, stalkers, hit record on your birthday, compare you to your friends, etc. are clickbait and should be avoided. Almost all of these apps abuse your friends. Some of them allow your account to do criminal activity, such as, post sunglasses or shoes for sale tagging your friends without your knowledge. Some of them do even worse stuff, such as, compromise your account and use your account to surreptitiously to do a host of bad activities.

Q: Are Android apps safer than Apple apps?
A: Most apps are not developed by Google, Microsoft or Apple. If someone is giving an app away, it is probably for ill purposes. Nevertheless, the advantage of Android — it is built on Linux (open source code.) This means anyone can see the source and/or fix the computer code. That is not the case with Apple or Microsoft. We suggest Android on your phones and Linux on your computers.

Q: My tech-savvy son says it is safe to download apps from Google. Is the Google app store safe?
A: it’s not Google… it is the open source community. Google doesn’t own Android. Android is based on Linux (free open source software) the Linux community is serious about security. We’ve been involved with Linux development since the 1990’s. Apple and Microsoft are based on proprietary software which is the opposite of the open source philosophy. In any event, none of us like Google for other reasons; however, their exploitation of Linux is better for mankind than Apple and Microsoft. Google Android apps are a better bet than other OS’s (operating systems) because they use Linux. That doesn’t mean you should trust Google. Do not trust Google.

Q: What about GPS apps?
A: GPS apps are the most exploited function/app of a smartphone. Not only do private companies exploit the data but bad guys and our government do, too. So my advice is what I did for my Dad. He suffers from dementia and tends to wonder off. We got a Metro PCS smartphone and the sole use is for tracking my Dad with a GPS app. If you want a GPS, use a separate device.

An example of a GPS smartphone app scam recently happened in Chester County, PA. Bad guys hacked GPS apps and sent fraudulent email traffic tickets to unsuspecting motorists. (2)

References:
1) Apple’s App Store infected with XcodeGhost malware in China after major security breach. China’s “Great Firewall” may have been partly to blame for the first major attack on Apple Inc’s (AAPL.O) App Store, but experts also point the finger at lax security procedures of some big-name Chinese tech firms and how Apple itself supports developers in its second biggest market. A malicious program, dubbed XcodeGhost, hit hundreds – possibly thousands – of Apple iOS apps, including products from some of China’s most successful tech companies used by hundreds of millions of people. (Reuters)

2) “Beware This Crazy Speeding Ticket Scam” Philadelphia-area residents have been targeted, and the level of information the perpetrator has is downright scary. The Tredyffrin Police Department in Chester County announced the speeding ticket scam this week, explaining that three local residents reported receiving emails notifying them of speeding infractions. Tredyffrin doesn’t have speed cameras, and the police say that they have nothing to do with these citation notices, but here’s the thing: The residents were, in fact, speeding at the locations cited in the citations. How is this possible? Well, investigators suspect that a hacker has exploited a security flaw in some GPS-enabled smartphone apps. (Philly Magazine)

More Internet Security

bookmark_borderThe World’s Smallest Movie

The star of the new movie made by IBM is 1/25,000,000 inch tall.

The ability to move single atoms, one of the smallest particles of any element in the universe, is crucial to IBM’s research in the field of atomic-scale memory. In 2012, IBM scientists announced the creation of the world’s smallest magnetic memory bit, made of just 12 atoms. This breakthrough could transform computing by providing the world with devices that have access to unprecedented levels of data storage. But even nanophysicists need to have a little fun. In that spirit, the scientists moved atoms by using their scanning tunneling microscope to make … a movie, which has been verified by Guinness World Records™ as The World’s Smallest Stop-Motion Film.

Exploring the limits of storage … and moviemaking

Today, it takes roughly one million atoms to store a single bit of data on a computer or electronic device. A bit is the basic unit of information in computing that can have only one of two values, one or zero. Eight bits form a byte. Recently, IBM Research announced it can now store that same bit of information in just 12 atoms.

From 1,000,000 to 12 — that’s a dramatic breakthrough that not only has the potential to make our computers and devices smaller and more powerful, but also holds enormous implications for the way entire industries operate.

bookmark_borderSpace Debris and Data Security

Cyber Security at the Membrane Domain
Hire Cyber Security Experts

 

Committed to promoting safety and transparency in the space domain, U.S. Strategic Command maintains a registry of tens of thousands of man-made objects in space and shares the information freely with anyone who seeks it through a command-run website.

Air Force Space Command, recognizing that collisions could damage orbiting satellites and cause more space junk, started the database as a pilot program before turning the project over to Stratcom in 2010, said Air Force Col. Lina Cashin, Stratcom’s division chief for space, cyber and deterrence policy and security cooperation.

The project, which involves regular tracking of old rocket bodies, debris and about 1,000 active satellites, has become one of Stratcom’s most universally popular products, Cashin said.

Space-Track.org has 85,000 account holders in 185 countries.

In addition to providing basic satellite catalog data to all account holders, Stratcom provides more advanced data services on request. The command also has agreements in place with 35 commercial companies to expedite information-sharing, and hopes to enter similar agreements with space-faring nations to better support their space operations, Cashin said.

Space situational awareness is crucial to Stratcom’s efforts to understand what is going on in space and to cope with the increasing amount of space debris, she explained.

Both the National Space Policy and the National Security Space Strategy call on the United States to be a leader in sharing satellite positional information to the greatest extent possible, Cashin said.

“We think that providing more transparency on the data that we have to satellite owners and operators — whether they are commercial, intergovernmental or foreign entities — promotes a more stable environment in space,” Cashin said.

“We want to share information with the rest of the world that we think can help them, and in turn help us be more responsible space operators.”

The registry serves a two-fold mission for those with satellites in orbit or planning to launch them, she explained. Nations and commercial companies can tap basic satellite data to plan space launches that won’t collide with objects already in space. And in the event that one of their satellites comes dangerously close to another object, Stratcom provides emergency notification so they can adjust course, if necessary.

During 2012, the command provided orbital data to 90 commercial and foreign organizations and 180 U.S. entities, Air Force Gen. C. Robert Kehler, Stratcom’s commander, reported to Congress last month.

“We received nearly 500,000 satellite observations and screened over 1,000 active satellites on a daily basis,” he told the Senate and House armed services committees. Based on those screenings, he said, the command issued more than 10,000 warnings of potential collisions, supported 75 “avoidance maneuvers” to prevent them and filled more than 300 requests for orbital data from 85 entities.

“Those numbers will go [up] every year,” Kehler told Congress. He emphasized the need for improvements to Stratcom’s space situational awareness capabilities and established “rules of the road” that govern behavior in space and allow the command to detect problems as they occur.

Space has changed dramatically since the Russians launched Sputnik in 1957, Cashin said. Sixty nations are now considered “space-faring,” with others anxious to join them to take advantage of the communication, navigation and other capabilities satellites and other space-based assets provide.

That makes space situational awareness more important than ever before in what Cashin characterized as an increasingly congested, competitive and contested domain.

In addition to the tens of thousands of fist-size manmade objects Stratcom regularly monitors, those too small to be tracked with current sensors could reach into the hundreds of thousands, she said.

The collision of an Iridium Communication Inc. satellite and a Russian Kosmos satellite in 2009 generated some 2,200 pieces of trackable debris. China’s anti-satellite test in 2007 generated more than 4,500 pieces — more than 3,000 of them still in orbit, and many to remain so for hundreds of years, Cashin said.

Meanwhile, space is increasingly competitive as more countries, civilian agencies and commercial companies jockey for an advantage within increasingly limited real estate.

Particularly coveted is the area of geosynchronous orbit at an altitude of about 22,000 miles directly over the equator, explained Air Force Brig. Gen. David Thompson, Stratcom’s deputy director for global operations. This orbit provides the best location for communications satellites, all requiring separation from other satellites to prevent interference.

“Those specific spots and those orbits are increasingly scarce, increasingly expensive and increasingly sought-after,” Thompson said.

That’s made space more contested as users want to take advantage of what it offers — and sometimes deny others’ access in the process.

Kehler told Congress he’s made a priority of ensuring that space capabilities that have become integral to the American way of warfare are available “whenever and wherever they are needed.”

The general also emphasized the importance of promoting trust and collaboration in space, a global common shared by nations and nongovernmental space operators around the globe.

Cashin reiterated the importance of promoting trust and collaboration in space.

“We are shifting to be completely transparent and share with our allies and partners so we can promote a … safe and stable space environment that benefits us all,” Cashin said. “As space becomes increasingly congested, competitive and contested, collaboration with our allies is more important now than ever before.”

By Donna Miles, from www.defense.gov
American Forces Press Service

bookmark_borderGoogle and Wikipedia Blackout Protest Over U.S. Internet Legislation

#SOPA #PIPA

If you go to Wikipedia.org today, you get a black page asking you to protest. If you to Google today, you will find their logo blacked-out and a plea to protest. WordPress.org, The Membrane.com and KingArthur.com have also *blacked-out* in support of the protest.

What has Internet intellectuals all in an up-roar?

Millions of Americans oppose SOPA and PIPA because these bills would censor the Internet and slow economic growth in the U.S.

Two bills before Congress, known as the Protect IP Act (PIPA) in the Senate and the Stop Online Piracy Act (SOPA) in the House, would censor the Web and impose harmful regulations on American business. Millions of Internet users and entrepreneurs already oppose SOPA and PIPA.

The Senate will begin voting on January 24th. Please let them know how you feel. Sign this petition urging Congress to vote NO on PIPA and SOPA before it is too late.

Tell Congress: Don’t censor the Web

Fighting online piracy is important. The most effective way to shut down pirate websites is through targeted legislation that cuts off their funding. There’s no need to make American social networks, blogs and search engines censor the Internet or undermine the existing laws that have enabled the Web to thrive, creating millions of U.S. jobs.

Too much is at stake – please vote NO on PIPA and SOPA.

— Google

Wikipedia Homepage Blackout Protesting USA Legislation
Wikipedia Homepage Blackout Protesting USA Legislation
Google Homepage Blackout Protesting USA Legislation
Google Homepage Blackout Protesting USA Legislation