Hello, everybody. Welcome back to firewall, Stone stop
dragons. I'm your host, Gary Parker. As always.
We have episode 385
today for 07/15/2024.
And we got a new show for you
today I have plenty of interesting topics to
cover real quick though before we get to.
I wanna give you an update on the
book surge.
We'd we didn't meet any of the milestones
I'd hoped for,
which is a shame. We got actually very
close to cracking the top 10 in
basically all 3 categories. I think at 1
point we were, maybe 13 on 01:15
on another
very close to the top 10, and I
think in the low twenties on the third
category. Most of that happened on Monday and
Tuesday, which, you know, kinda makes sense the
I imagine most people got the podcast on
those days. And if they were gonna do
it, they did it because they were waiting
to do it because I said to wait
to do it. So
you know, that's kinda when we spiked. I
was hoping maybe we could get a little
surge for the weekend, but it just definitely
did not happen.
So, nevertheless,
Thank you very much for everybody who participated,
but I'm gonna try 1 last thing
just to see,
and I'll tell you more about that after
the news. So stay tuned.
We'll we'll try once more. We're gonna focus
on a single day this coming weekend. Front
of you who miss it last week, this
will be an opportunity to try
again. And I I don't know if it's
still going. I didn't realize this when I
first started to but Amazon leaks currently is
running a buy 2 get 1 free or
buy 3 for the price of 2. That's
how I think they phrase it You know,
so if you wanted to buy multiple copies,
you know, maybe give 1 away or give
1 your local library or senior center or
something like that,
this would be,
a great way to do that. I will
say more about that after the news.
Also as promised, I will be giving away
a free ticket to Def con 32 in
Las Vegas, Nevada, that will go from August
eighth through August eleventh.
Though, if you're gonna go all the way
to Vegas anyway, you might wanna go a
couple extra days and go to b sides
as well. It's even cheaper and also fun.
But the ticket that we have to give
away is for Def con itself. It is
a 480
dollar value, the cost I gone up quite
a bit. That's cheap for a tech conference,
but it's kind of expensive for Del Con.
I think when I first started going a
few years back It was in the 300
dollar range
So, anyway, that may mean that they're gonna
give a really cool electronic badge this year.
I haven't actually looked into that to see
if that's the deal. But regardless, it's a
free ticket to Def con I'm basically gonna
do a straight up raffle for this because
I realized that, you know, not that many
of you will both be willing and able
to go. But if that interests you at
all, Def con is a lot of fun,
You might wanna go back and listen to
some of my Def con podcast to get
a,
flavor for what it's like. If you just
go to podcast podcasts that firewalls, don't dot
dragons dot com and search on Def con,
you'll find those episodes pretty quickly. But if
you ever thought about going, and this would
be 1 to go, and I will offer
a little bit more incentive to do so,
and I'll get into those details after the
news. Alright. So we got a good news
show for you today. And lots of good
juicy topics to cover.
We'll start off with a, an Australian man
was charged with running a fake Wifi
router on domestic airline flights.
A lawsuit against Airbnb and b about hidden
cameras has exposed some interesting data on the
number of complaints that people staying there have
had over the years about
being secretly recorded.
Some popular links,
mesh routers
have been shown to
send the Wifi
credentials and plain text across the Internet, which
is not a good thing. There's a new
password cracking list
making the rounds called Rock 20 24.
I'll explain a little bit about the history
of that.
But it p contains 10000000000
unique
plain text passwords.
Also, there's been another At and T
Data breach, this 1 involving call records and
text records
and the metadata surrounding those.
Signal has been under fire this week on
social media,
Thanks to a rather
provocative post from a security researcher and a
mis who we've talked about here before. There's
a lot to unpack there.
And I've got... I have opinions.
And we'll talk about that quite a bit.
Mozilla has announced a trial for their privacy
preserving ad
attribution
technology,
which apparently has been going on for a
couple years now, and I really either missed
it or forgot about it, but it has
come back up because they are putting it
in Firefox
and turning it on by default, which I
do not appreciate. So, we will talk about
that quite a bit as well. And then
finally, Proton
continues to release
very
welcome new features for their product line, and
they have finally come out with a Google
docs replacement.
That is end to end encrypted. And finally
from my to of the week, I'm going
to tell you how and why
to block
advertisements.
So lots of stuff to talk about. Let's
get right to it.
Alright. This is from the hacker
An Australian man has been charged with running
a fake Wifi f access point during a
domestic flight with an aim to steal user's
credentials and data.
The unnamed 42 year old allegedly established fake
free Wi Access points, which mimic legitimate networks
to capture personal data from unsuspecting victims who
mistakenly connected to them according to the Australian
federal police or the A fp. The agency
said the subject was charged in May of
20 24 after it launched in launched an
investigation a month earlier,
following a report from an airline about a
suspicious Wifi Work identified by its employees during
a domestic flight. A subsequent search of his
baggage on April nineteenth led to the seizure
of a portable wireless access device, a lap
laptop in a mobile phone. He was arrested
on May eighth after a search warrant was
executed at his home. The individual is said
to have staged what's called an evil twin
Wifi attack across various locations, including domestic flights
and airports in Perth, Melbourne, an adelaide to
imp legitimate Wifi f networks.
Users who attempted to connect to the free
pho network were prompted to enter their email
address or social media credentials through a captive
portal webpage page. I'll come back to that
in a second. This is a quote from
the F quote.
The email and password details harvested could be
used to access more personal information including a
victims online communications, stored images and videos or
bank details unquote. The defendant has been charged
with 3 counts of
unauthorized impairment of electronic communication and 3 counts
of possession or control of data with the
intent to commit a serious offense.
Has also been charged with 1 count of
unauthorized access or modification of restricted data, 1
count of dishonest obtaining or dealing in personal
financial information and 1 kind of possession of
identification information. If convicted, he faces up to
a maximum of 23 years in prison.
And here's a final quote from A quote.
To connect to a free Wi network, you
shouldn't have to enter any personal details such
as logging in through an email or social
media account.
If you do want to use public Wi
hotspots,
install a reputable virtual private network or Vpn
on your devices to encrypted secure your data
when using the Internet unquote.
Okay. I'm... I'm gonna come back to that
as well, But but going all the way
back for a second. So basically what this
person did was they carried equipment with them
onto these planes,
to set up a wifi Network. Battery operated
or something. And that Wifi network probably imp,
the Wifi Network that was available in the
airplane because it's easy to do. All you...
The the Ssid, the thing that says, you
know,
free qantas airlines, wi, or whatever,
that's just a string that anybody can type
into their Wifi Router, and and he named
his the same thing or something similar, something
that looked
like it was supposed to be free, you
know, airline Wi or whatever. And so people
nearby would connect to that Wifi hotspot that
he had control over
And then, as part of the connection process,
you can throw up this captive portal. And
if you're not familiar with that, if you
been to anyway so free public Wi,
they often... No matter what you try to
connect you once you, connect to the Wi
And, you know, they throw up this starter
page says, hey, thanks for using our free
Wifi.
Agree to these terms and conditions by checking
this box, you know, read this policy here,
what you no never does. And then click
here to continue. And then once you do
that once, it remembers you and you can
go surfing the web as usual. At places
like hotels,
oftentimes the cap affordable have you entered maybe
your name and or room number so they
can kinda keep track of who you are.
But to my knowledge, they don't actually check
that. So you can put whatever you want
there. But in this case, this person threw
up a captive portal that asked for
credentials for social media accounts and things like
that. And then once you put those in,
that... You've given this person your credentials to
that account and they can do whatever they
want with that account. So back to the
advice given it by the, the A here,
a Vpn would not have helped in this
situation. You still would have had to gone
through this captive portal. So,
a Vpn would not have prevented that. And
you still could have been tricked into giving
away your credentials. The main takeaway honestly for
me is what I'll keep telling you guys
is that is, I I never use public
Wi.
So if I'm on a plane even if
they've got free Wifi F, I just I
just don't use it. We're we're used to
not having Wifi an airplane. So I just...
So I just don't use it. If I
were, if there was some sort of emergency
situation, then, yes, I would use Vpn. But,
again, that wouldn't protect for this particular case,
so you still have to be careful. And
if you sign into 1 of these Wifi
things and I asked you to give away
credentials for social media or something,
that should be a huge red flag. So
instead of public Wi, I use my phone's
hotspot feature. Which most modern phones now have
available and most
cellular accounts now include, you might have to
pay for a higher level plan to get
that. But that's what I do now instead
of using public Wi.
Alright. Moving on. This one's from 9 to
5 Mac, and it's about hidden cameras and
Airbnb properties
I spoke about a while back... There was
some other new story about this. But the
the key to this story is that,
because of a lawsuit around this,
some,
internal data has been released, and it's not
good.
A previously un lawsuit regarding hidden cameras and
Airbnb properties reveals that the company generated 35000
support tickets by customers complaining about surveillance devices.
A lengthy Cnn report says that the problem
appears to be a substantial 1. Thousands of
images have been recovered from short term rental
host by law enforcement.
Hidden cameras placed in bedrooms and bathrooms showing
guests during their most private moments. Changing clothes,
being with their children even having sex according
to Cnn review of Court Police records, as
well as interviews with nearly 2 dozen guests
who found surveillance devices at short term rental
properties
or were told by police that they had
been secretly recorded. But the scale of the
problem had previously been unknown due to a
number of Airbnb policies and practices.
These include seeking to settle cases through arbitration
and failing to notify police even when it
seems clear a crime has been committed. And
this appears to be a quote from the
Cnn report. During the hours long deposition, the
Airbnb employee also revealed that when a guest
complains of a hidden camera, the company doesn't
as a matter of practice,
notify law enforcement not even when a child
is involved. The company may, however, reach out
to hosts about complaints
as part of internal inquiries, a move law
enforcement experts say could hinder criminal investigations because
it gives suspects time to destroy evidence.
Airbnb seeks to compel planets into arbitration, a
process that hides cases from public view, according
to 6 attorneys who represented clients and cases
against the short term rental platform.
When a settlement is reached, Airbnb has required
users to sign confidentiality agreements which bar them
from discussing details of the deal.
Airbnb told Cnn, its use of arbitration and
non disclosure agreements are standard practice within the
industry, and that is sadly true. Okay, Back
to the article, a court ordered the company
to disclose how many planes it had received
about surveillance devices in Airbnb properties in the
past decade, and it responded that 35000
tickets had been raised.
Europe regulates the short term rental industry imposing
wide ranging controls and how companies like Airbnb
can operate, but the Us has no similar
federal
regulations. That can says the report allow the
company to claim it is only a tech
platform
and not responsible for anything that happens at
the rental properties.
Airbnb makes this argument under section 02:30.
Legislation intended to protect web publishers from liability
from comments posted by users. And this is
a quote from Shannon Sc, who's a Florida
attorney who settled an Airbnb Sue for a
client, saying, quote, they're not arguing. This didn't
happen. Your client isn't injured. They're arguing, we
aren't responsible,
unquote. But 1 member of Congress hopes to
change that. Illinois representative Jan Chi cask, who
has introduced legislation that aims to curb big
technologies companies use of section 02:30,
argued that the platform would be safer if
Airbnb were forced to take responsibility for what
happens at its listings.
Right now, section 02:30 is used as a
get out of jail free card, the Democratic
lawmaker said. Now, Airbnb responded to this article
and they said, The company told us that
35000 tickets does not correspond to the number
of complaints as some complaints can generate multiple
tickets. It also stated that the tickets related
to surveillance devices, which can include things like
doorbell cameras and noise sensors.
Airbnb added that some of the tickets also
refer to false alarms where a retro believes
a camera is present when it isn't.
Okay. So, yeah, That does muddy the water
some, but
that's still an awful lot of complaints. Now,
this whole section 02:30 thing really doesn't make
sense to me. I don't know how Airbnb
claim to be
a platform, like a social media company. It
that just doesn't make sense. If they're talking
about comments posted on forums that they host,
you know, on their website, you know, maybe
comments and reviews for properties? Okay. Then Section
02:30 would make sense. I mean, that they
shouldn't really be held liable if somebody posts
a really nasty comment. But I don't know
how in the world you try to apply
section 02:32 their policies around hidden web cameras
on their properties. That that that doesn't make
any sense to me whatsoever.
So anyway, take away here,
again,
be aware that when you're going to Vr
or Airbnb or some of these other services
that let people rent their homes out to
other people. There are some un people who
will hide
you know, surveillance cameras and not tell you
about them. Airbnb has policies that says they
must disclose these things now, which is something
they didn't always have, but apparently they have
now. You're supposed to know where they are,
and there's never supposed to be a camera
and an and, like, bedrooms and bathrooms and
places like that where you're likely to be
in states of un andres.
But it is still a problem. And 1
that you should be aware of.
What do you do about it? It's it's
really kinda hard to do anything about it.
There are some techniques that you can use
to try to spot hidden cameras, but it's
it's not that easy to do. These cameras
are super tiny they're you can hide them
just about anywhere they're very difficult to find
if they're hidden properly.
The other takeaway from me here is that
this forced arbitration stuff has got to change
I understand certainly why companies want to do
this, but I don't know why we let
them get away with doing it. Our court
system isn't imperfect. It's backed up.
Arbitration can be good, but, you know, there's
still some transparency that needs to go along
with that somehow. But anyway, I'm I'm not
a lawyer, so maybe Should just stop talking
about that because I
don't really know what I speak So alright.
Moving on. This next 1 is from Stack
Diary, and it's a site that I don't,
but 1 of my followers pointed me to
this, and thank you to them. And it's
about some serious security problems with Links as
routers?
According to tested Coup, a Belgian equivalent of
the consumers Association. 2 types of links routers
are sending Wi login details in plain text
to Amazon Aws servers. This discovery involves the
Links
V, that's VELP,
pro 6 e and pro 7 mesh routers.
These look... These are little pillars that kinda
look like about the size of a pringles
can maybe except they're more squared often than
round.
So if you have a links list router
that looks like that in your house,
pay attention to this. During routine installation checks,
test and coupe
detected several data packets being transmitted to an
Aws server in the Us. These packets included
the configured Ss ssid name, that's the Wifi
f name that you would see when you
bring up your phone and say connect to
this network and the name provided there. That's
the Id name. So it include the Sis
Id name and password in clear text.
The identification tokens for the network within a
broader database and an access token for a
user session potentially paving the way for a
man in the middle attack. A man in
the middle attack is a security breach in
which should attacker intercept the communication between your
Lin router and the Amazon web server
without either party's knowledge. In this context, means
the attacker could capture your Wifi network name
or the Ssid and password as they are
transmitted in plain text
allowing them to read or alter these sensitive
details to potentially gain unauthorized access to your
network.
The consumer organization conducted these tests using the
latest firmware available at the time. Despite warning
Links in November, no effective measures have been
taken.
Links this released a firmware update after the
initial warning, but it did not address the
concerns raised, and this is a quote from
someone at Tested coup, quote, we regret the
lack of response from Links and expected more
from such a renowned brand on, unquote.
Test group suspects the security issue might stem
from third party software used in Lin as
firmware. However, they emphasize that this does not
excuse the vulnerability.
For those who already own the affected routers
they have recommended changing the Wifi Network name
and password
via the web interface instead of the app.
This precaution prevents the Ssid name and password
from being transmitted in readable text.
Test and coupe contacted Links us again just
day before today's publication in response to the
year ongoing issue, giving them a brief window
to respond. However, they have not received any
acknowledgment or a solution from the manufacturer.
And again, another quote from the researchers quote,
the vulnerability persists even in the latest Links
7 pro highlighting a critical security lapse. While
breaching in that requires effort and technical skill,
the attacker can cause extensive damage once inside.
Links list themselves recommended the V product lines
for small offices making this issue particularly concerning
for both personal and professional environments.
Alright. So what what it sounds like is
there is an app to set up these
routers,
which is becoming more and more common these
days with smart devices.
And when using that app to set up
these devices with the password and setting the
Ssid,
and it looks like the app or the
routers are sending
some information up to some cloud server somewhere
for links is probably or maybe for a
third party, I'm not sure, but that that
communication sends the
credentials for... The credentials for your Wifi router
uni uninterrupted. If they were really able to
intercept this, That means the communication itself wasn't
encrypted which today is almost unheard of. And
if someone were able to intercept that communication
somehow, you know, maybe you're in apartment complex
or you're you're in a neighborhood with close
houses and somebody in nearby just kinda of
sniffing the air for
for
communications like this. If they were to intercept
this then they would be able to get
on your Wifi F network and then get
up to all sorts of no good. Now
how likely is that to happen?
I don't know. But it really is a
horrible mistake by Lin, and they're right. I
mean, links is a huge name and in
networking products and
that this should not have happened. My guess
is probably the same as the researchers and
that is it may not have been links
as code doing this, It may have been
some third party library or or S sdk
that they were including that is making this
mistake. But nevertheless links this should be testing
their products and should be... Should have caught
this a long time ago. And should have
fixed it right away when notified. So if
you have these products, you could log in
to the web interface for your router that
is, you know, get on the Wifi network
Or if these devices actually have an ethernet
plug on that, I'm not sure if they
do.
But you should be able go to the,
administrator page for the the router, which is
special designated web page or, manual that comes
with the router, which you could probably download
online if you don't have it anymore. We'll
give you instructions of how to do that.
And then you change the password there,
then apparently, that does not send it in
the clear to to the web. So that
would be a good idea.
Alright. Next up, This is from Cyber news,
and it's about the next iteration of what's
called the Rock
password list. Which is basically a list maintained
by maintain and traded
amongst hackers
for trying to brute force passwords. And this
1
is now the official largest known, which contains
10000000000
unique passwords.
The king is dead. Long lived the king.
Cyber news researchers discovered what appears to be
the largest password
compilation with a staggering
9948575739
unique plain text passwords.
The file with the data titled ro 20
24 dot text was posted on July fourth
by 4 user Obamacare.
That's an odd name for a hacker, but
okay. The team cross referenced the passwords included
in the Rock 20 24 leak with data
from Cyber news leaked password Checker,
which revealed that these passwords came from a
mix of old and new data breaches. And
this is a quote from the researchers they
said, quote, In its essence, the Rock 20
24 is a compilation of real world passwords
used by individuals all over the world.
Revealing that many passwords for threat actors
substantially heighten the risk of credential stuffing attacks,
unquote.
Credential stuffing attacks can be severely damaging for
users and businesses. For example, a recent wave
of attacks targeting set satanic ticket master, advanced
Auto parts, quote wizard and others was a
direct result of credential shopping attacks against the
victim's cloud service provider snowflake.
Also from the researchers quote, threat actors could
exploit the Ro 20 24 password compilation to
conduct Brute force attacks and gain unauthorized access
to various online accounts used by individuals who
employee passwords included in the dataset unquote. The
Rock 20 24 compilation did not just fall
from the sky.
3 years ago, Cyber news published a story
about the Ro 20 21 password compilation, the
largest at the time with 8400000000.0
plain text passwords.
According to the team's analysis of Rock 20
24,
attackers developed a dataset by scouring the Internet
for data leaks, adding another 1500000000.0
passwords from 20 20 through 20 24,
and increasing the dataset set by 15 percent.
The Ro 20 21
compilation an expansion of a data breach from
2009
included tens of millions of user passwords for
social media accounts. Since then, however, the compilation
has balloon
exponentially. Most likely, the latest Ro iteration contains
information collected from over 4000
databases over more than 2 decades.
The Cyber news team believes the attackers can
utilize the 10000000000 strong Rock q 20 24
compilation to target any system that isn't protected
against Brute force attacks. This includes everything from
online and offline services to Internet facing cameras
and industrial hardware. 1 more quote from the
team, quote, moreover, combined with other leaked databases
on hacker forms and marketplaces, which for example,
contain user email addresses and other credentials Ro
20 24 can contribute to a cascade of
data breaches financial fraud and identity theft quote.
While there is no silver bullet to protect
users who had their passwords exposed,
impacted individuals and organizations to should take up
mitigation strategies.
The Cyber news research team advises to 1,
immediately reset the passwords for all accounts associated
with leaked passwords.
It is strongly recommended to select strong unique
passwords that are not reused across multiple platforms.
2 enable defect authentication or M mfa wherever
possible, this enhances security by requiring additional verification
beyond a password.
And 3, utilize password manager software to securely
generate and store complex passwords.
Password managers mitigate the risk of password reuse
across different accounts.
Cyber will include data from Rock 20 24
in the leaked password checker, allowing anyone to
check if their credentials were exposed by the
latest record holding exposed password
compilation. Alright. So let me just explain what
this what this is.
Really, all this is is a massive text
file full of
breached passwords.
Passwords that have been
discovered
or hacked somehow,
over the past, basically 2 decades. These are
gonna include things like password or password 1234
or monkey 123.
You know, all the really bad passwords that
we that we know and love.
But 10000000000 of them, 10000000000
unique ones.
Now I tried to download this file.
There were a couple places I found in
the web that had it, but they were
really, really slow and the file was enormous.
And a lot of people were saying that
it's full of a bunch of junk too.
So apparently, it's not a clean listing of
10000000000 passwords,
but this Rocky thing has been around for
a while. And if you have done any
basic hacking,
you will be familiar with it. There are
cyber tools like John The ripper,
that use lists like this to automate brute
force attacks. In other words, to take all
these passwords
and probably pre hash them using, several common
hash techniques.
And then when they get a password database
somewhere, look at all the hash passwords and
see if there's any matches.
And then they would then know what your
underlying password is. Or sometimes what they'll do
is they'll just take these passwords and take
a list of users that they that know
have account on, let's say a certain bank
or social media accounts and they may have
gotten this from other places and just combine
the 2 and say, okay, just start trying
all these passwords with all these email addresses
and see if any of those combinations actually
get, you know, get me in. That is
a brute force attack.
And it's not done by hand. It's done
by computers, so it can happen very, very
quickly. And that's why it's important
for sites that accept credentials over the web,
to have protections like rate limiting, like, you
know, you can't enter a, you know, million
passwords per hour. If you fail 10 times
in a row, they should cut you off
for an hour or a day,
but there's a lot of sites that do
not do that. And if the thing that
they are attacking is something that's offline,
if they, you know, steal your laptop or
steal your phone or something that has password
protections on it, and they actually have it
in their possession.
They can lose their computer on it and
just try as fast as possible.
And if you're using 1 of these passwords,
then they may eventually
get in. So that is why you need
a password manager to generate crazy,
random,
long, strong, unique passwords for all of your
sites. And you don't have to remember them
or even type them in because the password
manager does all that for you. Alright. Next
up, this is from Tech ranch, and it's
about an, yet another At and T breach.
On Friday, which I think was just last
Friday. At and T said cyber criminals stole
the phone records of, quote unquote, nearly all
of its customers. A data breach that will
force the company to notify around a hundred
and 10000000
users.
At and T said the stolen data included
records
like which phone numbers a certain customer called
and texted, the total count of calls and
texts and call for a 6 month period
beginning May first of 20 22 through October
30 first of 20 22.
At and T said the stolen data does
not include any content of calls or tax
nor their time or date.
For some of the affected customers, the cyber
criminals were also able to steal sell site
identification numbers, linked to phone calls and text
messages according to At and T. This means
that potentially, someone could use this information to
figure out the approximate location of a customer
when they made a certain caller sent to
text, and perhaps infer sensitive information about their
lives. And this is a quote from Rachel
To,
social engineering expert and founder of Security firm,
social proof security. And, Rachel says, quote, this
could reveal where someone lives works spends their
free time, who they communicate with in secret
including affairs, any crime based communication or typical
private sensitive conversations that require secrecy.
This is a big deal for anyone affected
unquote.
At and T blamed the incident on a
recent breach at cloud service provider snowflake that's
the second time you've bed today. Which has
affected dozens of companies, including Ticket master, Sa
Bank and Lending tree subsidiary quote wizard.
At this point, it's unclear exactly who's is
behind the snowflake breach. Man, the cybersecurity firm
hired by snowflake to investigate
said a financially motivated criminal group they identify
as Un 5537
was responsible.
The type of data stolen an At and
T's data breach is tipped referred to as
metadata because it doesn't include the contents of
calls or texts, but only information about those
calls and texts.
That, however doesn't mean that there are no
risks for the victims of this breach. To
says that this type of data makes it
easier for cyber criminals to imp people you
trust making it easier for them to craft
more believable social engineering or phishing attacks against
At and T customers.
Another quote from Tow back, quote, The attackers
know exactly who you're likely to pick up
a call from, who you're likely to text
back
how long you communicate with that person and
even potentially where you were located during that
conversation due to the metadata that was stolen,
unquote. Rune Sand, the founder of Granite, a
firm that helps journalists and activist be more
secure said the, quote, Even if you don't
do anything important or sensitive,
who you talk to when and how often
is still personal to you and should remain
private to you as well.
I think everyone should be very angry about
this and demand better from the tel codes.
It's not enough to say, oh, by the
way, your data was taken. We are sorry
and taking this very seriously on quote, Sand
vic says it's more concerning for higher risk
individuals affected by the breach. Again, quote, some
may consider changing their numbers and using a
different provider, but it just really depends on
the circumstances end unquote. Higher risk individuals can
include those who have a reason to shield
their identities such as survivors of domestic abuse.
Sand vic also says that using encrypted chat
apps like signal, which doesn't hold the type
of metadata At and T just lost and
Whatsapp
could be better for security because these companies
have a better track record of protecting user
data. Jake Williams, a cybersecurity expert and former
Nsa hacker
told Tech crunch that the risk is greater
for businesses and intelligence targets following the At
and T breach. And this quote from Williams
quote, threat actors can use this data to
create patterns of life
Call data records provide a wealth of value
for intelligence, analysts
unquote. Williams also said that it's possible hackers
can combine this data with that of data
breaches because, quote, previous At and T incidents
mapped customer phone numbers to other identifying information
simplifying weapon of the newly compromised data. In
short, this data is a gold mine for
understanding who talks to whom, which can for
instance be used for developing human sources unquote.
Okay. So that's that's obviously not for you
and me likely.
This is more spike kind of stuff. Or
espionage kind of stuff. But nevertheless, this is
private data.
And for the few people whose,
you know, location information may have also been
leaked with the this metadata,
That could be a real problem, but I
also have to just agree with this sentiment
that it it is just no longer
acceptable for these companies who are leaking their
data like a sieve to come out and
say, oh, yeah. Hey. Sorry about that. We
really really value your privacy here is a
year of
you know, credit monitoring. And that's it. We
need to somehow be able to hold these
companies
accountable
for this. Because until there's a real financial
impact to them screwing up like this. They're
not gonna take security seriously. Like, why would
they? So again, what this is it's for
a 6 month period, 2 years ago,
this is a list of
most of At and T's customers,
text and call logs.
That apparently have, you know, who was talking
with whom, but not when or where in
most cases.
There's no content of the text messages, at
least from what they're saying so far and
definitely not contents of the of the phone
calls. But still. It's a massive data breach
and it's related... And it's related again to
this snowflake breach, which
just shows you how important these quote supply
chain attacks are. A lot of these big
companies
rely on a very few subset of important
tech companies that you've never heard of
until until these breaches occur, and then it
becomes a real problem. So we need much
more accountability for these security failures? Or they're
just gonna continue?
Alright. Just a couple more new stories and
then, a quick note about Proton, and then
we'll get to my tip of the week.
But these next 2 stories in particular are
gonna be a little bit longer and take
a little bit more analysis.
So this first 1 is from stack diary,
and it's about
a that happened on
social media between signal and a researcher or
or research team, both are true,
named My, YSK, and we've mentioned Mis before.
And
there's a lot of nuance to this, and
I've got a lot,
a lot of takeaways on this. But let
me let me read this and and then
I'll get to my take.
Popular encrypted messaging app signals is facing criticism
over a security issue in its desktop
application.
Researchers and app users are raised concerns about
how the app handles encryption keys on desktop
services against, so basically on your computer, which
is different from your smartphone.
According to cybersecurity researchers mask the desktop version
of signal stores encryption keys, in plain text.
An issue that potentially exposes users to data
theft.
Musk detailed the problems on Twitter, highlighting that
signals desktop app stores local chat history encryption
keys in a plain text file accessible by
any process on the system. And a quick
quote from Mis said, quote, end to end
encryption is useless if any of the ends
get compromised on quote, which is a point
that I've often made on this program.
According to My, signal users who link a
desktop app may have a false sense of
security.
They created a simple python script that copied
signals local storage directory on a Mac then
transferred this data to a fresh macos installation
in a virtual machine.
By placing the copy data in the appropriate
directory and installing signal on the virtual machine,
they successfully restored their entire signal session including
chat histories.
The researchers were then able to run 3
simultaneous
active signal sessions on the original Mac, and
iphone and the virtual machine
without any warning from signal about the cloned
session. Messages were delivered to either the Mac
or Vm With the iphone receiving all messages.
Importantly, the phone still only showed 1 linked
device failing to detect the unauthorized set on
the virtual machine. The ability to transfer chat
histories like this is not limited to Macos.
A user on Twitter showed that the encryption
keys and signals configuration file on linux are
set with permissions that make them readable by
any process the local user runs. This means
that while a key logger might require admin
access to install, any app script with sufficient
permissions could access these plain text keys. Naomi
Brock, who we interviewed here just a couple
of months ago, recommended un linking any desktop
service from signal accounts. Rockwell explains, quote, a
long known problem is that signal storage your
decryption keys on desktop and a plain text
file,
not your key chain, making it accessible to
any app,
unquote, but then she adds if you trust
your computer, you're fine, suggesting that users who
are cautious about their security might want to
reconsider using the desktop version of signal. Mixed
analysis aligns with a 20 18 report.
By bleep computer, which also highlighted the poor
handling of encryption keys and signals desktop app.
Signals approach to end to end encryption focuses
on protecting data in transit.
However, once the data reaches the user's device,
the responsibility for security largely falls on the
user.
While standard, this practice assumes the user's devices
are secure from Malicious software or unauthorized access,
which may not always be the case. In
20 18, in response to Bleep computers article
Joshua Lu who works at signal said the
following. The database key was never intended to
be a secret. At rest encryption is not
something that signal desktop is currently trying to
provide or has ever claimed to provide. Full
disc encryption can be enabled at the Os
level on most desktop platforms.
So considering this context, it's questionable why signal
stores chat history and encrypted form at all,
particularly since media attachments remain une unavailable, and
that's a link to another article which I'll
need to follow and I didn't realize that
media attachments were encrypted either. It's clear the
signal has not altered its approach to this
issue. We were able to confirm that on
a windows system Signal continues to store a
key to the config dot Json file in
the app data directory.
I was following this on Twitter. And Meredith
Whitaker, who's the president of Signal,
who... I have a lot of respect for
responded this way.
There's been some chatter about signal desktop recently,
so let's clear the air. 3 points. 1.
The reported issues rely on an attacker already
having full access to your device, either physically,
through a malware compromise or ava via a
malicious application running on the same device. This
is not something that signal or any other
app can fully protect against nor do we
ever claim to.
2, we continue working to harden our desktop
build across supported operating systems and take advantage
of new platform capabilities as they emerge. Those
of you following our repo can follow this
work there, and I'll come back to that.
And 3, the posters who raised this issue
did so without contacting us directly.
Instead they went straight to social media and
some cases using inflammatory language and they dropped
these claims over a Us holiday weekend.
This is the opposite of responsible disclosure.
We ask those who are serious about security
and privacy to please engage us directly in
the future instead of resort first to online
claims that can confuse non experts and lead
people to make unsafe choices and develop inaccurate
mental models based on scary language.
We monitor security at signal dot org carefully
and respond to all legitimate reports. Alright. Back
to the article, the response to meredith statement
has varying opinions on social media. Some users
argue that the issue of storing encryption keys
in plain text has been known for years
with the initial report dating back to 20
18, which this article just talked about. The
idea being that signal has had ample time
to address the problem.
Others criticized the assertion that full device access
is necessary for exploiting this vulnerability,
pointing out that access to user level files
is sufficient.
It's a tough 1 to balance. The mixed
reactions highlight the tension between immediate security needs
and developers practical limitations in safeguard local data.
On April first, a pull request was made
on github. This is their code repo for
signal that would alleviate this problem by implementing
electrons safe storage Api
and on July tenth, which was just last
week.
1 of Signals developers finally accepted the safe
store a Api poor request on Github that
which should mean that that
solution that was
posted on April first, which kind of addresses
this problem I'll come back in a minute.
Has been accepted and will go into a
future signal release. It is possible that the
concern about signals desktop encryption key storage may
be overblown.
1 user on Twitter contend that the current
setup is, quote, best for the masses, not
the extremely security conscious, quote.
This v viewpoint suggests that users highly concerned
about potential 0 day exploits or arbitrary code
execution should consider more stream measures such as
setting message expiration timers to very short intervals
or avoiding message retention altogether.
And that's referring to a signal feature where
you could actually have your messages
automatically deleted over a certain period of time
and you could do that per user or
per group.
And that user added, quote, even if you
install as root and use Su to open
it, there are still privilege
escalation 0 days, and I'm sure you don't
suspect to the source and check some of
all binaries areas you execute as root. This
isn't as big of an issue as it's
made out to be here unquote.
In a post on Mastodon, The researchers noted
that this practice is common among many applications.
They cited Whatsapp and Apple's imessage as examples.
Whatsapp apps chat context
can be accessed by any other launched application
without restriction.
I imessage, however, stores data in a sandbox
preventing
unauthorized processes from accessing it. In both cases,
attackers must first gain access to the local
user account to reach such application data. Once
this access is obtained, other data is typically
also vulnerable including locally stored documents that are
usually une encrypted unless users take specific measures.
The researchers point out that the level of
protection needed for chat content compared to other
locally stored data may vary depending on the
specific
situation.
Okay. So
there's kind of a lot to unpack here.
I've actually been debating this at length with
some of my
some of my privacy peeps. And I think
there's a lot of blame to go around
here. And
first of all, I... Yes. This was reported
in 20 18.
So it is a known issue. So in
that sense, Mis was basically saying,
look, there's no reason to go through this
private disclosure process because you've known about this
for years.
However, that said, the way it was presented
on social media was,
I think a little bit alarm.
And there is something to be said for
the fact that it's really, really hard to
secure
local data from malware
running on that machine because anything you can
do,
that Malware can do. And sometimes that Malware
can even do more. If you're if you
have a non administrator account as your normal
account, there are bugs in software which allow
Malware to gain
higher privileges.
And so, basically, I think signals perspective on
this, which appears to match that of you
know, other
applications that are privacy and security oriented is
that, look, if you manage to get malware
running on this system, if the endpoint itself
is compromised,
then there's not a whole lot we can
do. And so, therefore, we're not gonna bother
doing it.
They count on things like, you know, encrypting
your entire hard drive. To prevent somebody's from,
like, stealing your laptop or stealing your smartphone
and finding the keys and decrypt your stuff
because they won't be able to decrypt anything
because all the entire hard drives is encrypted.
But if you're malware running on that system
as the the logged in user or even
somebody with higher privilege, it's really hard to
hide stuff. From from that malware because they
have the same permissions you do, if you
can read your messages, they can read your
messages.
Even if the stuff was encrypted, that the
the malware may be able to launch the
app, maybe even behind the scenes without it
coming up and you're seeing it, you know,
launch it in an immediately
put it in your dock or something like
that, and then scroll through this stuff and
and screen grab it.
I mean, you know, there's a lot of
things you can do as now we're running
on a system that's very hard to protect
against. Okay. So so there's that. But I
also think that Meredith response was a little
bit tone deaf. I think I think you
could say all you on about some random
researcher, and this is, honestly, somebody who's done
some really good work in the past. And
you can kinda
complain about the way they approach this problem,
and I think some of those complaints could
be valid. That doesn't mean you have to
do the same thing. I I personally
if I were and Meredith position
would have been a little bit more diplomatic
about it than she was,
maybe Would've have reached out to them directly
and privately. You know, basically do the thing
that you wanted them to do with you.
And also, there are mitigation that can be
used. In fact, talked about it in this
article. There there are ways to
sandbox data so that, for example,
1 application running as the user
can't access data from another application even for
that same user. This is commonly done on
smartphones now. In fact, a lot of the
protections that are on smartphones phones really should
be migrated to desktop computers. They're pretty good.
So there are things that can be done.
There are mitigation strategies. There are
some steps that could make this better that
I think they should do. And it actually
kinda sounds like they might be doing them.
So after complaining after complaining about it, and
complaining about the way it was presented and
something that was brought up 5 or 6
years ago that they're finally just now addressing.
They are addressing it, And they're basically taking
this person's advice. Now it is possible. I
mean, I'm a software I've seen this happen.
It's possible for software companies of have any
size.
For things like this to just slip through
the cracks. Mistakes are made, people are human.
When this was first brought up in 20
18, some of these stand sandbox boxing and
other integration strategies probably didn't exist. And that
not trying to excuse this. Signal needs to
do better. They are the gold standard for
this as far as I'm concerned, I will
still recommend them, especially just for regular people
like you and me. But they need to
be making their stuff better constantly, and they
need to be receptive and responsive to criticism
like this, even when it's not done in,
you know, the best way.
So if you are in a high risk
category and you're using signal as a desktop
app. Well, first of all, you could... First
thing you could do is not use it
as a desktop app anymore, just use it
under Smartphone
But if you do use it under on
your desktop app and you link it to
your account, you might wanna set, you know,
just pairing messages so that the data is
deleted,
consistent basis
Obviously, you wanna make sure that your hard
drive is encrypted. You wanna be using the
latest version of signal because it sounds like
they might actually be putting some mitigation strategies
in soon. But otherwise, you need to follow
some very careful
Internet hygiene and computer hygiene to make sure
that you don't get infected because once you
get malware in your system,
you know, it's really, really hard to protect
it. Signal should do what they can, but
I don't consider it signals fault. If you
manage to get it infected by something else,
they there's a lot of different ways they
can try to get it your signal data.
No matter what protections signal tries to put
on it. End day end encryption is exactly
between the 2 endpoints, it is extremely secure.
But at the endpoints, by necessity, it needs
to be uni uninterrupted, so that the people
at either end could actually, you know, write
and read the messages.
And that means that if the endpoint is
compromised,
then that data is potentially vulnerable.
So act accordingly and
bake that into your threat models and
security strategies.
Oh, 1 more quick comment about this. The
whole thing about cl, the messages and taking
them to a different machine and having signaled
not call that out.
I would hope that signal would be able
to... If they haven't
built this in already,
defeat this particular situation. I mean, this is
another tricky thing. Like, let's say, I'm trying
to spy on somebody. I know that you
signal.
I managed to get access to the device
either through malware directly.
Getting into their account on the device, and
I do this. I copy off all of
their signal data. Okay. Great. I've got that.
But maybe they have
you know, the message is being deleted right
away or the on a very short term
basis. If I... Still... If I can copy
this data off of that machine to another
machine,
All of a sudden, that other machine is
basically a new signal client for that user
automatically logged in and good to go, and
now I can, you know, watch the messages
that go back and forth on that account.
And signal wouldn't call that out as a
new device. Like, hey, that's weird.
You know, maybe there's some ids buried in
there, but I'm like, I'm seeing this Id
twice. That's that's strange. I should call that
out. So that's something else is signal I
think needs to address here.
Alright. 1 more kind of controversial story here,
and then we'll, get to some lighter fare.
And and this is directly from Mozilla.
It's part of a press release they just
put out, and it's something that I either
mister or forgot about, but it's something they're
calling privacy preserving
attribution, and it's about a supposedly privacy preserving
way to do
track
ads. So anyway, let me let me read
this and I'll give a comment.
Privacy preserving attribution is an experimental feature in
Firefox version 01:28, which by the way just
came out. Mozilla is prototyping this feature in
order to form an emerging web standard designed
to help sites understand how their ads perform
without collecting data about individual people. By offering
sites a non invasive alternative to cross site
tracking, we hope to achieve a significant reduction
in this harmful practice across the web.
Attribution is how advertisers learn whether their advertising
works.
Attribution measures how many people saw an add
on a web site, and then later visited
the advertisers website to do something the advertiser
cared about. For example, maybe someone sees ad
for a sale on a product, and then
buys that product.
Attribution counts how many people do that.
Attribution is very important to advertisers.
Sadly, tracking is the only way to perform
attribution without help from the browser.
Tracking is terrible for privacy because it gives
it is detailed information about what you do
online. While Firefox includes many privacy protections that
make it more difficult for sites to track
you online,
like enhanced tracking protection, total cookie protection, query
parameter stripping and many other measures,
there's a huge incentive for sites to find
ways around these in order to perform
attribution. Our hope is that if we develop
a good attribution solution, it will offer a
real alternative to more objection practices like tracking.
We are currently testing this approach to see
if it can provide advertisers with the information
they're looking for.
P doesn't involve websites tracking you. Instead, your
browser is in control. This means strong privacy
safeguards including the option to not participate, and
I'll come back to that important point in
a second. P is enabled in Firefox starting
in version 01:28.
A small number of sites are going to
test this and provide feedback to inform our
standardization plans and help us understand if this
is likely to gain traction.
P can be disabled in Firefox settings.
Firefox provides an easy simple option to disable
the privacy preserving attribution feature if users prefer
not to participate.
Websites will not know if you chose to
opt out in this way. To opt out
do the following. And the menu bar at
the top of the screen, click Firefox and
select preferences or settings
depending on your Macos version in the privacy
and security panel, find the website advertising preferences
section and uncheck the box labeled allow websites
to perform privacy preserving ad measurements.
So the press release was longer than that,
and they get into some other stuff. It
also provides a link to
a much more detailed and technical
breakdown of what this P is actually doing
under the covers, which I did read through
and so I will give you my take
on what I found there.
First of all, let's state the obvious.
The way the the the web works today
is we have an ad based
quote unquote, free model where, you know, a
lot of sites don't charge you, and instead
sell ad space on their sites and make
money that way. And these ad companies, Google
and Facebook chief among them, But there are
there are others
really want to be able to go back
to the people advertising with them to give
them much information as possible about how effective
their ads are. That is this attribution thing
that we're talking about. And there's this notion
of
impressions,
and conversions. So an ad impression
is when
they can verify that somebody saw 1 of
your ads.
Sometimes it also means that they actually clicked
on 1 of your ads. It's that's it's
a 2 part thing, But those those are
ad impressions. Those are Those are the gotcha.
That is they successfully got their advertisement in
front of you. And then a conversion is
that you actually then
did something based on that ad that they
wanted you to do. And what that is
kinda varies depending on what they wanna measure.
Sometimes it's it's sufficient that you just got
to their website. Other times, they actually want
to know that you bought something from their
website. That is called a conversion. And since
these things often happen at different times, and
maybe even different devices,
they really have a hard time linking those
2 things together. But they desperately wanna do
so.
And and of course, the the classic quote
here, and I looked this up because I
wanted to know who said it.
Was by a guy named John Wanna,
and he is the creator of what would
eventually become Macy's, and he said this, like,
a hunt over a hundred years ago. And
the quote is half the money I spend
on advertising is wasted. The trouble is, I
don't know which half. That is what this
is trying to address. These people who are
trying to advertise their products and try to
get people to then go buy their products.
Need some way to know if the ads
they're placing are are working because, you know,
if they if they put their ad in
20 different places,
And only 2 of those places are actually
bringing in customers,
then they wanna focus their advertising on those
2 places and not on the others.
So this whole attribution thing is crucial for
somebody who's advertising.
And again, the way this really works is
there's people who want to sell products and
there's places that need to sell advertising space.
And then there's companies like Google who match
in between and put those together and and
know, take money from companies that wanna advertise
and then give that money to the websites
when they show ads and convert Yada. That's
the whole ad marketing thing that's happening here.
Now
I was kinda surprised as that Firefox was
doing this because Firefox is very privacy oriented
and the the threes reason in that I,
you know, often recommend them as my favorite
browser. It's the 1 I use on all
my devices. And they have gone to great
lengths to prevent this web tracking, and they...
Some of their technology is very good at
it. But these companies are so desperate
to do this attribution that they
are it's this constant cat and mouse game
where they're trying to work around all these
privacy protections to track you anyway. Now I
read through the technical diet details of this,
and it's actually...
It's certainly in spirit,
very similar to what Google is trying to
do with their privacy sandbox and their topics
Api. They're trying to
learn more about you in a way that
doesn't
impact any particular person's privacy. They're trying to
basically do a lot of this stuff in
aggregate.
And that is what Mozilla is trying to
do here as well. When I looked into
this also found out that they're working with
Meta. In other words, Facebook on this, which
is another
another black mark as far as I'm concerned.
But I understand again, why they're trying to
do this
as people are blocking through party cookies and
trying to block all this tracking,
they're desperately trying to find something that will
work that people will allow to work
so that they can continue with their advertising
business. They're trying to use some of these
privacy enhancing technologies, these Pet that we talked
about last week with our our nap,
specifically
Mo mozilla plan is using
differential privacy and multi party computation. They're trying
to do this right. And the ups shot
of what of what these things do. This
end Google's privacy sandbox is they're trying to
get the browser
to record all this information instead of the
websites you visit and know, recording this information
via third party cookies and such,
and keeping it all local to the browser,
and then have the browser
in a privacy preserving way,
aggregate and report this data in such a
fashion that nobody can figure out specifically
who that information is about. But in aggregate,
can see that, okay, you know, of these
10 websites where I posted this ad,
2 of them had a very strong conversion
rate. I don't know who did it. I
may know a little bit about when,
but that's about it. And by the way,
another way, that a... This attribution is often
done is through these promo codes. You see
these all the time. Right? Now you'll get
an email from somebody saying, hey, we're having
a special this week you bought from us
before, or you've been on our website many
times and never bought something. Here's a promo
code that you can use for the next,
you know, month or something to buy
a product and we'll and we'll give you
a discount. Well, that specific promo code helps
them attribute the advertising campaign directly, like whoever
uses that promo code,
you know, got it hopefully from their advertising
campaign. Now, course, there are deal coupon sites
that totally screw that up
by
publishing these promo codes
to everybody. And so that, again, that screws
up their whole attribution thing to the point
where a lot of times, once these codes
show up on those
deal coupon sites, they're canceled immediately because they're
now useless to them. The whole point of
the promo code was to help them figure
out
how to attribute the impression with the conversion.
Alright. Just a couple more notes about this.
So so far, this appears to only
handle the attribution aspect. Obviously, there's a lot
more to advertising that Google and Facebook offer
about very detailed demographics on people that are
looking at and buying their products. That is
not included in this whatsoever.
Also, this is a very limited trial. There's
only certain
websites that are even participating in this. It
is also not the full solution. They are
just testing part of this technology.
And also, I have to think that ad
blockers would completely
screw up this whole process because you're not
being showed the ads in the first place.
But if you're interested in the details, if
you really wanna dig into it, there are
links in the show notes that take you
to,
Mo mozilla is
more detailed description of this. It's it's it's
worth a rate. It's not super long. But
I'm gonna be keeping an eye on this.
And I will let you know what I
find. And the devil's is always in the
details. I'll be very interested to see what
other people think
about this and if they could find ways
to break it. If they can find ways
to
manipulate the system to still
track individual people.
Like, for example, looking at the technical details,
there's there's an ad campaign Id
that's recorded. If you were to give up
a particular their Id per person, that then
I would think you could track them. No
matter what you did to try to hide
their identity. But I wanna make 2 other
points at At a much higher level.
First of all,
this really kinda is the holy grail. This...
We... If we're going to say
that we want to have this ad driven
web economy where we have these quote free
services, and that we pay for them is
by looking at ads,
and not blocking them,
then coming up with some way to do
that that preserves our privacy
is a really, really big deal and worth
trying to figure out. I don't know if
they'll get there. But, you know, I applaud
the fact that they're trying.
On the other hand, Mo mozilla
is creeping me out that they're doing this
in the first place. Apparently, They've also recently
merged with or acquired an ad company.
You know, and they've gotta make money too.
I get it. I just don't like they're
doing it. More than I like that Apple
has its own ad business either. I think
they should just leave that alone. Of course,
Apple's
making
more money than just about any other company
on of the planet, and that is certainly
not the same as most Mozilla. But also,
they really
absolutely should not have turned this on by
default. I am sure that they needed people
to do this so they could test it.
And if they did it as an opt
in thing, they probably would have gotten no
uptake whatsoever.
I understand why they did it. But they
should not have done it that way.
So I'm sure we'll have more to say
about this in the future. I will keep
an eye on it, and I will report
back
as there are new developments.
Alright. Finally, I was gonna read this article
from Life factor, but... I'm just gonna summarize
it actually very quickly. You can... You can
still find the link in the share notes
if you want. But basically, Proton has just
come out with a end to end encrypted
private version of Google Docs. Something I've been
wanting
for so so long. I've only played with
it a little bit, but it does look,
you know, very full featured. It's got a
nice slick interface. It looks very reminiscent of
Google Docs. Have to play with it some
more to figure out if there's any major
features that I like that are missing, but
it looks pretty good so far,
but it's it's something that I've been wanting
for so so long. It's 1 of the
last few Google services
that I have not been able to replace.
So this is a really huge deal for
me.
If you have not tried proton at all,
this might be the thing that, you know,
gets you to give it a shot. They
do have a very usable free
tier that you can start with to play
play around with But I'm very interested that.
I have confirmed with Andy, the Ceo that
he's gonna come back and we're gonna talk
about this and other
new things that proton is doing and will
be doing in the near future. So I'm
very much looking forward to that. They've come
out with all all sorts of new stuff.
They've got the password manager. They've also just
released a new feature for their password manager
that allows you to securely share credentials with
people on a limited basis.
They're doing some great work. So I'm very
much looking forward to talking to Andy about
all that,
sometime in the next couple months.
Okay. So let's get to... Alright. So let's
jump to my tip of the week. And
I wanna talk to you again about
blocking ads.
It's obviously very relevant to something we're talking
about today. And it's something that I've covered
on and off over the years, I had
an older article
about this that I called on the ethics
of ad blocking. And I realized,
as I was doing some research for this,
that I wrote that almost 8 years ago
now. It still holds up pretty well actually.
I wanted to revisit it for the tip
of the week. And again, if you go
to firewalls don't dragons, the top blog article
there is the full length version of this
with all sorts of helpful links and other
information.
I highly recommend that you do that. And
if you want this information to just come
to you automatically
every 2 weeks, you can sign up for
my newsletter because my blog on my newsletter
are almost always the same thing. So really
quickly, ads are obviously, ubiquitous today.
They're
often very annoying. I understand that part of
it. But they're also a privacy risk and
even a security risk.
We've already talked about the privacy risks in
terms of a lot of these ads wanting
to track you and build these dossier on
you. But because of the way the ad
networks work,
and it's kinda like billboard space available for
anybody to buy, bad guys often buy that
space and put up fishing ads or even
ads that can deliver malware either by clicking
on them or in some cases just by
visiting the page. That's less common, but it
has happened. And so I think everybody is
perfectly within their rights to block most ads,
even just the annoying part. I mean, I
I've seen other people
browse the web who don't have ad blockers
installed, and I I just blows my mind.
I look... Out how can you even deal
with that? It's just so so annoying.
So I've been using an ad blocker for
a long time. And
as far as the ethics go, yes, these
websites need to show ads to make money
and they need money to survive. I get
that. So you know, there are ways that
you can certainly disable ad blocking on websites
that you want to
access because maybe they block you if you
don't turn off your blocker,
or because you wanna support them. You are
gonna take some risks in doing that, but
it's often possible to actually view the ads
and still block the tracking. Which the solutions
I'm going to give to you today will
hopefully do for you.
So there's 2 kind of basic ways that
I talk about blocking ads. First of all,
is is in your browser. And the best
way to do that is to install u
block origin. There are many ad blockers out
there,
it's been called the biggest boycott in history
because there are so many of them than
so many people use them, because we all
hate these horrible horrible annoying ads. But the
best 1 by far. Bar on
is U block origin. Now do not confuse
that with u block.
This is something I I kinda wish 1
of these guys would change the names. But
you block and u block origin are not
the same thing, and there's a long
nasty history between those 2 products, the 1
you want for sure.
Is you block origin.
And to get the full benefit of u
block origin, you need to use a browser
like Firefox
because all the Chromium based browser, including Google
Chrome and Microsoft Edge are now using this
thing called Manifest v 3, which basically
prevents U block origin from doing
what it really needs to do to to
properly block ads. In fact, they had to
come up with you block origin light to
address those browsers because they can no longer
do what they what they used to be
able to do. So another reason to switch
to Firefox.
Now if you... For some reason, don't like
you black origin, you can also try Ef
efs privacy badger,
or Duck goes privacy essentials. They also do
similar things. You could theoretically
install
2 or 3 of if you wanted to,
they call kinda do the same thing and
they do it a little differently.
They can
interfere with each other some.
But from my experience, u block origin is
all you need.
And u black origin has got a lot
of other really cool features,
that let you get rid of, other pop
ups and things that's got this little zap
feature you know, when something pops over and
you just... And you visit that site all
the time, you're tired are seeing the pop
up saying, subscribe to my newsletter, you can
actually with u block origins zap those, so
they're never shown again. Which is wonderful.
But the other 1 I wanna spend more
time on today is what I don't talk
about as much. And that is blocking ads
using Dns or the domain name system. So
again, the domain system is kinda like the
phone book for the Internet. It converts
names to numbers,
and instead of
person's names to telephone numbers it converts domain
names like firewalls don't strap dragons dot com
to an Ip address like 34 dot 1
74 dot 87 dot 100.
That last 1 is something that we don't
like as humans, but computers, that's what they
need to to wrap these things. So this
is the conversion your computer is doing whenever
it's trying to get to websites.
And websites with ads
have all sorts of well known
advertising
domain names
that they go to call out to to,
you know, to show these ads. So you
can just intercept that lookup
And whenever it's for a well known ad
site, just don't let that route through. And
then those ads can't show up. Your browser
can't fetch them.
1 of the really cool things about using
Dns
is that it's not just for your web
browser. A lot of your apps on your
computer are also doing the same thing if
they've got... If it's a free app that
you've installed in your computer that's ad based,
it can sometimes block those ads as well.
But if you go even 1 step up
in the food chain. If you go up
to your router, your home router,
your Wifi at home and and set that
Dns on that device, which will then propagate
to all the other devices in your home,
You can now block ads for everything within
your home network.
Now there can be exceptions to that. Each
device in your home could
theoretically
define its own Dns server, but generally, the
way it works is when these devices come
up and asked to get on the network,
part of the information provided by the router
other than the Ip address to use locally,
is also, hey. When you wanna do a
Dns query, here's where you should send it.
Usually, that's to the router and then the
router sends it on to wherever they wanna
do it.
By default, the way that usually works as
it goes to your Internet service provider.
And your Internet service provider by the way,
uses that information to track
all the websites you go to. And and
may even be bundling those up and selling
those to somebody else as well. So another
great reason to use
some Dns besides your Internet service providers to
deny them
at least a way to easily track where
you go. They're even if you don't do
Dns lookup through them, they could still see
the Ip addresses as you go to and
they can look those up as well, but
it's it's not quite a straightforward.
So within the whole Dns solution, there's 2
solutions that I'm gonna propose. First of all,
next Dns.
There are other ones to do this as
well, but Next Dns is my favorite. It's
extremely customizable, it's very, very powerful and it
just works like a charm.
So Next
has a free version, but it's limited to
how many queries you could do per month.
I just pay for it. It's not that
expensive. I think it's like, 50 bucks a
year or something like that. And when I
set my home router to
use that Dns, and so every device in
my house then uses next Dns for dns,
I get ad blocking on every device in
my home. Is fantastic.
Now for devices that can leave my home,
like my smartphone and my laptop, you could
also configure Dns directly on those devices,
to use Next Dns as well. And if
you go to the Next dns site, they've
got a really nice, listing there for how
to set set up Next Dns at all
those devices, In some cases you download this
profile and it's just a matter double clicking
this profile and and your
operating system saying, are you sure you wanna
do this and you say, yes,
And then now you're using that Dns. It's
actually gotten pretty simple. And then you can
go to the next Dns dashboard and get
also is a really cool.
Analytics to see how many ads you've blocked
and where they're coming from and things like
that. It's really neat. Tech, which is a
fantastic website and Henry and those guys are
some of my favorite privacy people.
They have done a really
detailed next Dns video. It's about 40 minutes
long.
I've got a link to it in and
show notes that's well worth the watch. Because
Next Dns does so much more than just
had add in tracker blocking.
So that's option 1. Now if you're a
do it yourself or if you're a hobby,
if you like to
mu around with computers and electronics,
Another solution that's kinda similar is a project
called Pi hole.
And that's PIH0LE,
pie like the the Greek letter. Because it's
based on the Raspberry pie mini computer. And
you could buy a raspberry pie for about
35 bucks, but you'll also need to buy
a power supply and a case and an
Sd card if it'll run you maybe a
hundred bucks when it's all said and done.
But basically, you set up this little dedicated
Dns server in your house
and then you point your router to that
for Dns lookup ups. Effectively, it does the
same thing, and it's also got some fun
dashboards and things. It's a little more involved,
You know, hey, if you don't wanna pay
in an ongoing subscription for next Dns, and
you wanna, you know, have all little funnel
order project.
That is a cool way to go. The
only thing... The only downside of that is
for your devices that leave your home.
It's kinda harder to use that pie. You
can set up, you know, Vpn connections back
to your home
router that peek into your raspberry pie, but
that's that's a pain in the butt. So
anyway, I have migrated to Next dns and
I have loved it.
But if you wanna, you know, get little
more geek and try something on your own,
check out the pie hole project.
So there are a couple caveats and garages
to this whole thing. When you start introducing
things like e block origin or next dns,
either 1 of them. They start blocking things,
and some websites just do not like that.
Some will detect that you are trying to
block ads and complain, and they'll either not
let you into their site until you've disabled
your ad blocker or sometimes they'll just pop
up a warning and if You kinda have
to look for the the little hidden link
that says, continue this time, and I promise
next time, I'll I'll block my ads. They're
all a little bit different. But some websites,
they just outright break. Like, things just don't
work. Like, whoever design that webpage page did
not take into account the fact that somebody
might go to the trouble of blocking certain
elements of that page from loading. So some
websites were just not function. Like, they won't
load at all, or they're partially load or
you'll They look like they load, but then
you go to fill out a form or
click a button and nothing happens.
You'll need to be aware that when you're
using these kind of
technologies, it can cause things like that to
happen and you're gonna have to do some
debugging. You can actually pretty easily just turn
off you block origin for example on any
given website either temporarily or permanently,
and then reload the page and see if
it works, and then you'll know that was
the problem. If it's next Dns, however, you're
actually gonna have to log into your Next
dns account. Look at the logs. It'll show
you like, live,
updates of what was recently blocked and why.
And, you know, you may find it something
there. And then from next Dns, you can
put it on your allow list either temporarily
or permanently
and see if that fixes your problem. It
sounds bad and it can be frustrating. It
doesn't happen that often. I just want you
to be aware that it can happen when
you're doing this sorts of blocking.
Now by the way, there's no reason you
can't do both. I do both. I have
both do black origin and next Dns. They
do different things in different ways. They don't
really interfere with each other, it just does
mean that if you have to debug now,
you've got check both those as possible sources
of the problem.
1 more thing I will add is that
if you use a Vpn, a lot of
times your Vpn service will have its own
dedicated Dns service.
So unless you do some kinda tricky
configurations. When you're using a Vpn, often that
means you're not using next Dns, But, you
know, if you're using you v block origin,
then you're still gonna get that protection. You're
just not gonna get the Next Dns protection.
In fact, a lot of times I actually
use this
fact
that the Vpn doesn't use Next dns because
oftentimes what I'm like, in a newsletter or
somebody sends me
form
email that they sent to a lot of
people,
the services that send mass mailing often replace
whatever links are in that email with special
redirect links because they wanna know who clicked
on what and when.
And those redirect links under the covers
can be blocked by next Dns.
So you'll click on the ads and they
just won't go anywhere. They don't work.
And so in cases like that, often what
I'll do is I'll just quickly turn on
my Vpn and click on it again and
very often then it will go through and
then I'll turn my Vpn back off. Yes,
that means that some analytics somewhere knew that
I clicked on that link. But in most
cases, that's all they're looking for is just
knowing that someone did click it, and that's
that's fine. So there you have everybody, your
news and your tip of the week.
All everybody do it this week. Thank you
for tuning in.
A couple quick reminders. First of all, do
take your questions, Listener our questions, dear carry
questions.
You can go to FDSD
dot me slash QNA.
That link is in the show notes, or
you can just send me an email at
dear carey at firewalls don't stop dragons dot
com. And that's CAREY.
So real quick on the book search. First
of all, again, thank you very very much
to everybody who participated. I'm sure we sold
a good number of books, We got very
close to hitting the top 10. If you're
curious, I do have some statistics on that
and some graph.
I will try to put that up somewhere.
I'm not maybe I'll add that to the
bottom of the book search blog post on
my website. But we got very close to
the top 10, And I I wanna give
it 1 more shot. So what I'm gonna
do
is for Saturday,
July twentieth. I'm gonna pick a single
day. So if you
missed it last week for some reason or
didn't get around to doing it, and would
like to try again.
Go to amazon dot com and buy a
copy of my book this Saturday, July twentieth.
If you are willing to buy more than
1 copy, currently, Amazon has a 3 for
the price of 2 sale going on,
It's not just my book it's other stuff
too. So I guess actually you might be
able to use that to buy some other
books besides mine. But if you wanted to
buy 3 copies of my book for the
price of 2, you could give the extra
copies to friends and family or maybe to
your local library,
a local high school library maybe or a
senior center. That's a great place for this
book.
So that... That's a that's a potential option,
and you could do that. And if you
can do it on Saturday,
we'll see if we can't focus all of
our attention on a single day and give
1 more shot to crack into the top
10.
Because we didn't really hit... We didn't really
hit the milestones. I did get some extra
reviews just a handful, which is look, better
than nothing,
but it's really, really hard to get reviews.
I definitely need more. You could still do
that because I would also like to get
the average rating my book up. Only went
up a tenth of a point. I really
like to get it up higher. So that
is something else you could do. I don't
know if doing that on Saturday really counts.
Actually, I think it takes them, like, even
24 hours before the review posts. So maybe
you could do it on Friday. I don't
know that I even matters as far as
timing. But that is still something I would
love to have you do. So we'll give
that 1 more shot. Because we didn't really
make the milestones. I'm gonna hold off on
planning a Zoom call,
nevertheless, you know, if you did do something
here, you know, save some evidence of that,
take a screenshot of your social media post
or
your purchase email or something like that. Just
hold just hold onto to it. I've got
a couple more campaigns I wanna run in
the next 2 or 3 months or so.
And at the end of all that, I
think I'm gonna have a thank you Zoom
party. And so you'll need someone to punch
that ticket
to to to get your invite to that
party. So hold on to that evidence.
I may be asking for that later. Now,
I do have 1 more promotion.
And thank you very much to Grey fox,
who is what of... Which is the handle
for 1 of my patrons
who had an extra ticket to Def con
and is offering it up to me to
give away to you.
I realized this is only going to
appeal to a limited number of you. First
of all, you've gotta be able to go.
Again, it's August 8 through eleventh in Las
Vegas, Nevada,
So you... You're gonna have to buy a
plane ticket, and you're gonna have to get
lodging. But if you'd like to get in
and say 4 and 80 bucks,
We've got a ticket to give you. So
I'm going to do a straight up raffle
on that. If you're willing able to go,
send an email to me at dc c
24 as in dev con 24.
Dc c 24
at firewalls don't dot agnes dot com. And
I'll put that in the show notes too
So you don't have to remember it. But
shoot me an email and say that you'd
like to enter that raffle. Now, I am
gonna throw in 1 other bit of incentive.
As you know, I give away Dragon challenge
coins from time to time, and
besides having this really super cool dragon coin,
that also doubles as a d 20 die
that you can use to generate past phrases
at my website, d 20 key dot com,
if you should ever meet me in person
and present this coin, I will buy you
a drink on me. So I'm gonna offer
here as an additional incentive to
do this raffle
is if you sign up to be an
annual patron at the night aren't level or
higher
and you in the raffle, I will personally
hand you a dragon challenge coin and buy
you a drink on the spot in wonderful
Las Vegas Nevada when we both go
to Def con. And note that I'm still
doing the Treasure chest promotion that's an ongoing
thing for people who sign up as a
patron for night Erin and above,
And that is you basically get a 40
dollar value
coupon for either malware bites, proton
or safe port master. So it covers a
good bit of your of your annual subscription.
So that's all kinda wrapped into it. If
you've got any questions, you can let me
know when you send me an email a
24 at firewalls stones dot dragons dot com.
I will announce that winner probably in 2
weeks. I wanna make sure I have time
to get it to everybody but before we
go to Las Vegas.
So sometime the next 2 weeks if you
wanna enter into that raffle for a free
ticket to Def con 32, just shoot me
that email. And you can wait of course
until
you you find out if you win if
you also want to become a patron to
do the Dragon coin thing. That's totally up
to you. Alright. We're already running long. So
let me cut it off here. We've got
a great interview next week on Os or
open source intelligence with Jason Edison from Intel
techniques. That's a... Was a really great interview.
So stay tuned for that. And lots of
other great stuff coming down the pike. So
if you haven't already subscribed and then you
won't miss any of that goodness.
Alright. Take care everybody. Stay safe out there
and until next week as always.
Don't get caught with your dr