FFT news digest — 4 January 2019
FFT news digest — 4 January 2019
Facebook tracking
More evidence of the extent of Facebook tracking has emerged, with research showing that popular Android apps, including Skyscanner and TripAdvisor, send it data without user consent. Privacy International examined 34 apps and found 23 of them transmit data as soon as they’re opened, before a user can provide permission. The information includes a unique Google ID that can be used to track a user’s internet activity. The data transmission takes place regardless of whether or not the user has a Facebook account and, in the case of the Kayak travel app, it included details of every flight search. Privacy International questions whether such behaviour is permitted under EU data protection rules. Facebook responded by saying it was working on “a suite of changes”, including its Clear History tool.
Lock up your router
Two hackers have highlighted the risk of incorrectly-configured routers by hijacking thousands of Internet-connected TVs. The hackers - who now appear to have ceased their antics - exploited routers which were configured to open specific ports to the internet. Smart TVs and other Internet-connected devices use these ports so they can be managed by other devices on the same network. But, unless care is taken, they can also expose the device to the Internet and they can then be identified using a simple search tool. Routers have become a popular target for attackers because, once installed, they are seldom touched unless they go wrong. To mitigate this risk, it’s essential to make sure their firmware is kept up to date and to change any default passwords. You can use this tool to check whether ‘uPnP’ is set up correctly on your router. If it isn’t, you should check your manufacturer’s website for advice on what to do.
Lawful hacking
The importance of firmware security has been illustrated by research into how a malicious software tool infects Windows PCs. Speaking at the Computer Chaos Club conference, ESET researcher, Frederik Vachon, explained how the tool hijacks a vulnerable driver which is loaded when the machine starts up. ESET has linked the software, dubbed LoJax, to the Fancy Bear hacking group which UK security officials have connected to the Russian government. LoJax was first revealed last September after ESET found it on a customer’s machine. The tool is usually delivered as part of a targeted (spearphishing) email and, once installed, is extremely difficult to remove. ESET has urged users to make sure Windows devices are configured to use Secure Boot. This is easy to enable and most PC manufacturers provide instructions on their website.
Internet control
Bangladesh and the Democratic Republic of Congo (DRC) restricted Internet connectivity in connection with elections in the countries, in a growing trend towards shutting down communications at sensitive times. In Bangladesh, the Telecommunication Regulatory Commission said high speed mobile coverage was halted “to prevent rumours and propaganda surrounding the vote.” There was no official announcement in the DRC where mobile and broadband Internet was affected, but a presidential adviser told Reuters that Internet and text messaging services would remain offline until the publication of full election results on January 6. Figures from digital rights group, Access Now, show the number of Internet shutdowns rose from 108 in 2017 to 188 last year. In Africa and Asia especially, it’s clear that it is not possible to rely on connectivity that is supplied and controlled locally.
In brief
In brief