By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy

Apple says it will roll out a new privacy control in the spring to prevent iPhone apps from secretly shadowing people. The delay in its anticipated rollout aims to placate Facebook and other digital services that depend on such data surveillance to help sell ads. Although Apple didn't provide a specific date, the general timetable disclosed Thursday means a long-awaited feature known as App Tracking Transparency will be part of an iPhone software update likely to arrive in late March or some point in April. After delaying the planned September introduction of the safeguard amid a Facebook-led outcry, Apple had previously said it would come out early this year. Apple released the latest update as part of Data Privacy Day, which CEO Tim Cook will salute during a speech scheduled Thursday at a technology conference in Europe. Apple has been holding off to give Facebook and other app makers more time to adjust to a feature that will require iPhone users to give their explicit consent to being tracked. Analysts expect a significant number of users to deny that permission once it requires their assent. Currently, iPhone users are frequently tracked by apps they install unless they take the extra step of going into iPhone settings to prevent it. Facebook stepped up its attacks on Apple’s new privacy control last month in a series of full-page ads in The New York Times, The Wall Street Journal, and other national newspapers. That campaign suggested some free digital services will be hobbled if they can’t compile personal information to customize ads. On Wednesday, CEO Mark Zuckerberg questioned Apple's motives with the changes, saying the iPhone maker “has every incentive” to use its own mobile platform to interfere with rivals to its own messaging app. “Apple may say that they are doing this to help people, but the moves clearly track their competitive interests,” Zuckerberg said. Google, which also relies on personal data to power the internet's biggest ad network, hasn't joined Facebook in its criticism of Apple's forthcoming controls on track. Google profits from being the default search engine on the iPhone, a prized position for which it pays Apple an estimated $9 billion to $12 billion annually. But Google warned in a Wednesday blog post that Apple’s new controls will have a significant impact on ad revenue generated from iPhones in its digital network. Google said a “handful” of its iPhone apps will be affected by the new requirement, but did not identify which ones. “We remain committed to preserving a vibrant and open app ecosystem where people can access a broad range of ad-supported content with confidence that their privacy and choices are respected,” wrote Christophe Combette, group product manager for Google Ads. Follow this and other developments on OUR FORUM.

MeWe, a social media app centered around data privacy, has seen a surge in downloads in recent weeks as Big Tech companies crackdown on user content. The app that calls itself the "anti-Facebook" added 2.5 million new users last week, bringing its total userbase to 16 million -- 50% of which live outside the U.S., MeWe spokesperson David Westreich told Fox Business. "People all over the world are leaving Facebook and Twitter in droves because they are fed up with the relentless privacy violations, surveillance capitalism, political bias, targeting, and newsfeed manipulation by these companies," Westreich said. "MeWe solves these problems." He added that the platform "is the new mainstream social network with all the features people love and no ads, no targeting, no newsfeed manipulation, and no BS." MeWe, which said it surpassed 8 million users in June, ranked No. 7 overall and No. 4 among social media apps by U.S. iPhone downloads on Jan. 10, according to mobile data and analytics provider App Annie. The week prior to that date, MeWe sat outside the top 1,400 apps overall and at No. 66 among social apps, App Annie found. The app on Thursday sat at No. 14 among social media apps on the App Store and No. 13 among all free apps on Google Play after several days of skyrocketing downloads. The app told ZDNet that its users spikes frequently when people are looking for an alternative social media app to Facebook, Twitter, and the like that does not infringe on the privacy of its users. The website's "About" tab says MeWe users have control over their own interaction and privacy settings, and the platform does not sell or share user data with advertisers. "The big technology companies, you know who they are, had reverted to treating [users] as commodities," MeWe's website states. "They somehow mistook people signing up to use their services as a welcome invitation to target, track, spy, and sell our information to advertisers and the government. All in all, it felt pretty creepy." MeWe aims to offer an alternative to those websites by offering "decency, privacy, and respect for social media users." Other social media and communication apps with a focus on privacy have also seen surges in downloads over the last two weeks after the Jan. 6 Capitol riot. Big Tech companies including Facebook, Instagram, Twitter, and YouTube have made a number of policy changes and updates since the riot in an effort to quell violent or conspiratorial rhetoric on their platforms. The policy changes have promoted social apps that do not censor content or emphasize data privacy like Parler, DuckDuckGo, Signal, and Telegram to see spikes in user numbers. Encrypted messaging app Signal, for example, ranked No. 1 among overall and social media apps by U.S. iPhone downloads on Jan. 9 and Jan. 10. The week prior, it ranked No. 927 among overall apps and No. 45 among social apps, according to App Annie. DuckDuckGo, a search engine and Google alternative that does not profit from user data hit No. 1 among overall U.S. iPhone downloads and No. 1 among utility apps on Jan. 10, up from No. 308 and No. 14, respectively, the week before. "These types of shifts in messaging and social networking apps are not unusual," Amir Ghodrati, director of market insights at App Annie, said in a statement. "Due to the nature of social apps and how the primary functionality involves communicating with others, their growth can often move quite quickly, based on current events. We’ve seen growing demand over the last few years for encrypted messaging and apps focused on privacy." Learn more at OUR FORUM.

Attackers hid inside Windows systems by wearing the skins of legit processes. The SolarWinds hackers triggered one of their Cobalt Strike implants in the firm's network through a cunning VBScript that was activated by a routine system process, Microsoft has said. Microsoft's deep dive, published yesterday following SolarWinds' own take on the malware, repeated earlier findings that the hackers went to unusual lengths to disguise their intrusion and avoid detection. Specifically, the compromised DLL file was quietly deployed onto targeted systems by mimicking legitimate file names – and the attackers worked between 8 am and 5 pm to increase the odds of not being spotted. It continued: "Applying this level of permutations for each individual compromised machine is an incredible effort normally not seen with other adversaries and done to prevent full identification of all compromised assets inside a network or effective sharing of threat intel between victims." Much of the infosec commentary around the SolarWinds supply chain attack has reused the tired old clichés of stating the attackers were sophisticated, advanced, cunning, soft, strong, thoroughly absorbent, and so on. In this case, the clichés appear to be true because the attackers "first enumerated remote processes and services running on the target host" and only moved through the target network "after disabling certain security services." Those techniques included editing the Windows registries of target machines to disable autostarting of security processes – and then waiting until the target machine was rebooted before moving in for the kill. "The combination of a complex attack chain and a protracted operation means that defensive solutions need to have comprehensive cross-domain visibility into attacker activity and provide months of historical data with powerful hunting tools to investigate as far back as necessary," Microsoft sighed. The analysis includes indicators of compromise and techniques used by the attackers to skate around SolarWinds's networks but, unusually for infosec research, expresses them in plain English that any averagely skilled IT pro can follow. It's well worth a read. The attackers also used the mildly unusual reflective DLL loading attack technique. A full explanation can be read here, also from Microsoft. Briefly, the technique allows malicious DLL files to be loaded into a process without first having been registered with it – and does so from memory, via a custom loader deployed by the attacker, rather than pulling it from a potentially detectable disk location. Relatedly, custom Cobalt Strike loaders developed by the hackers strongly resembled "legitimate Windows file and directory names, once again demonstrating how the attackers attempted to blend in the environment and hide in plain sight," said MS. The autopsies of the biggest supply chain attack for years will doubtless continue, but one thing's for sure: whichever nation-state was behind it, they really knew what they were doing and really didn't want to be caught in the act.  Follow this thread and more on OUR FORUM.

The data regulator for the German state of Lower Saxony has fined a local laptop retailer a whopping €10.4 million ($12.5 million) for keeping its employees under constant video surveillance at all times for the past two years without a legal basis. The penalty represents one of the largest fines imposed under the 2018 General Data Protection Regulation (GDPR) not only in Germany but across Europe as well. The recipient is notebooksbilliger.de AG (doing business as NBB), an online e-commerce portal and a retail chain dedicated to selling laptops and other IT supplies. The State Commissioner for Data Protection (LfD) for the state of Lower Saxony said that the company installed two years ago a video monitoring system inside its warehouses, salesrooms, and common workspaces for the purpose of preventing and investigating thefts and tracking product movements. Officials said the video surveillance system was active at all times, and recordings were saved for as much as 60 days in the company's database. But while the retailer thought it was running a banal video monitoring solution, as found in many other businesses across Germany and all over the world, the German data regulator found it to be a gross encroachment on the rights of German workers. "We are dealing with a serious case of video surveillance in the company," said Barbara Thiel, head for LfD Lower Saxony, in a press release earlier this month. "Companies must understand that with such intensive video surveillance they are massively violating the rights of their employees." The German data regulator argued that employees do not have to give up their right to privacy because their employer puts them under suspicion of potentially committing a crime in the future. "If that were the case, companies could extend surveillance without limit," Thiel said. The German official claimed that video surveillance was not to be used as a "deterrent" to prevent crime but only when an employer had justifiable suspicion against certain employees. In those cases, employees could be monitored for limited periods of time until the suspicion was confirmed, and not for years in a row. "Video surveillance is a particularly intensive encroachment on personal rights, because, theoretically, the entire behavior of a person can be observed and analyzed," Thiel said. The LfD head said that because of the constant video monitoring, employees are under continuous stress and pressure to behave as inconspicuously as possible in order to avoid being criticized for their behavior. Furthermore, the German data regulator said that NBB also recorded customers while testing devices in its salesrooms without their knowledge or consent, which represented another major privacy breach. But in a PDF statement published on its website, NBB CEO Oliver Hellmold said the fine and accusation that it monitored employees were unfounded. "At no point was the video system designed to monitor employee behavior or performance. It wasn't even technically equipped for it," Hellmold said. The NBB CEO accused the LfD Lower Saxony office of misconduct. He argued that officials didn't visit its premises during the three-year investigation and that NBB previously made adjustments to its video surveillance system at the office's request in order to become compliant. Furthermore, Hellmold called the fine disproportionate to the company's size and said that they plan to appeal. "It is absurd that authority imposes a fine of more than 10 million euros without sufficiently investigating the matter. Apparently, an example is to be made here at the expense of our company," he said. Continue reading on OUR FORUM.

Parler’s website suddenly appeared online Sunday with a message from its CEO, John Matze, who said, “Hello world, is this thing on?” The message suggests Parler was able to find another hosting service, coming about a week after Amazon Web Services booted the social media website from its services, taking the site down. It came as Parler—billed as a “free speech” platform—was seeing an unprecedented surge in users as prominent conservatives, among others, were being banned from Twitter, Facebook, and other platforms. Matze also issued a temporary status update. “Now seems like the right time to remind you all—both lovers and haters—why we started this platform,” Matze. “We believe privacy is paramount and free speech essential, especially on social media. Our aim has always been to provide a nonpartisan public square where individuals can enjoy and exercise their rights to both. We will resolve any challenge before us and plan to welcome all of you back soon. We will not let civil discourse perish!” Amazon Web Services’ rationale behind jettisoning Parler was due to a lack of moderation and came in the backdrop of the Jan. 6 U.S. Capitol riots. Parler, in a court filing, citing text messages between Matze and an Amazon representative, claimed Amazon was primarily concerned with whether President Donald Trump would migrate to Parler after his Twitter account was banned last week.

LAWMAKERS AND LAW enforcement agencies around the world, including in the United States, have increasingly called for backdoors in the encryption schemes that protect your data, arguing that national security is at stake. But new research indicates governments already have methods and tools that, for better or worse, let them access locked smartphones thanks to weaknesses in the security schemes of Android and iOS. Cryptographers at Johns Hopkins University used publicly available documentation from Apple and Google as well as their own analysis to assess the robustness of Android and iOS encryption. They also studied more than a decade's worth of reports about which of these mobile security features law enforcement and criminals have previously bypassed, or can currently, using special hacking tools. The researchers have dug into the current mobile privacy state of affairs and provided technical recommendations for how the two major mobile operating systems can continue to improve their protections. “It just really shocked me, because I came into this project thinking that these phones are really protecting user data well,” says Johns Hopkins cryptographer Matthew Green, who oversaw the research. “Now I’ve come out of the project thinking almost nothing is protected as much as it could be. So why do we need a backdoor for law enforcement when the protections that these phones actually offer are so bad?” Before you delete all your data and throw your phone out the window, though, it's important to understand the types of privacy and security violations the researchers were specifically looking at. When you lock your phone with a passcode, fingerprint lock, or face recognition lock, it encrypts the contents of the device. Even if someone stole your phone and pulled the data off it, they would only see gibberish. Decoding all the data would require a key that only regenerates when you unlock your phone with a passcode, or face or finger recognition. And smartphones today offer multiple layers of these protections and different encryption keys for different levels of sensitive data. Many keys are tied to unlocking the device, but the most sensitive ones require additional authentication. The operating system and some special hardware are in charge of managing all of those keys and access levels so that, for the most part, you never even have to think about it. With all of that in mind, the researchers assumed it would be extremely difficult for an attacker to unearth any of those keys and unlock some amount of data. But that's not what they found. "On iOS in particular, the infrastructure is in place for this hierarchical encryption that sounds really good," says Maximilian Zinkus, a Ph.D. student at Johns Hopkins who led the analysis of iOS. "But I was definitely surprised to see then how much of it is unused," Zinkus says that the potential is there, but the operating systems don't extend encryption protections as far as they could. When an iPhone has been off and boots up, all the data is in a state Apple calls “Complete Protection.” The user must unlock the device before anything else can really happen, and the device's privacy protections are very high. You could still be forced to unlock your phone, of course, but existing forensic tools would have a difficult time pulling any readable data off it. Once you've unlocked your phone that first time after a reboot, though, a lot of data moves into a different mode—Apple calls it “Protected Until First User Authentication,” but researchers often simply call it “After First Unlock.” If you think about it, your phone is almost always in the AFU state. You probably don't restart your smartphone for days or weeks at a time, and most people certainly don't power it down after each use. (For most, that would mean hundreds of times a day.) So how effective is AFU security? That's where the researchers started to have concerns. For more visit OUR FORUM.