Friday, August 17, 2012

Twitter + location = WeKnowYourHouse

Calling itself "another social networking privacy experiment", WeKnowYourHouse scours Twitter for people using the word "home" in their tweets and picks up their associated geolocation, then publishes said tweet to its site along with information about where the tweeter is.

The site tells you where the person is, plots them on a map, shows you the Google Street View picture of that location, tells you nearby places they've found on Foursquare, crime statistics for the area, local photos posted to Instagram near that location, and even shows an advert where you can "Meet local sl**s". Nice.

The site promises that it only keeps the last hour of data, and then fully deletes it, but it's scary to see how much information can be compiled against someone so quickly, using information that is freely available.

It reminds me of the "NeedADebitCard" Twitter account, which scans Twitter for the words "debit card" and an associated photo, and then publishes the photo and tweet.

It's crazy how much personal information people keep pumping out for the world to see. To repeat part of Duck's advice:

    Turn geolocation services off. Giving out regular and precise updates of your whereabouts is convenient - but you should consider your location to be a form of PII (personally identifiable information).

WeKnowYourHouse agrees: "Our advice is don't check in at your own home, whether using Twitter with locations, Foursquare, Google Latitude, or any other location-aware service, because you're telling the world exactly where you live."

But what do you think? Is it a useful site to make people aware of the risks of having location services turned on? Or is it an invasion of privacy, pulling all the information together as an "experiment", when these people haven't opted in?

source http://nakedsecurity...eknowyourhouse/

Kim Dotcom Must Be Allowed To See FBI Evidence Against Him, Court Rules

The bid to have Kim Dotcom extradited to the United States suffered a significant setback today. US authorities had insisted there was no need for them to reveal the evidence they hold against the Megaupload founder. But today a New Zealand judge upheld an earlier decision and ordered the US to reveal the evidence they are relying on to have Dotcom and his associates shipped to the United States, including details of covert operations and confidential discussions with rights holders.

Posted Image

Responding to a request from Megaupload’s legal team, Judge Harvey at the North Shore District Court ruled in May on whether the United States government should be forced to reveal the evidence it holds on Kim Dotcom and other defendants in the case.

Megaupload said they have a right to see the case being built against them but the United States insisted that no right to disclosure exists. Judge Harvey disagreed with the prosecution and ordered disclosure of all documents relating to the alleged crimes of the so-called Megaupload Conspiracy.

“In my view there must be fairness and the hearing and balance must be struck, otherwise the record of case becomes dominant virtually to the exclusion of everything else and places the extradition process in danger of becoming an administrative one rather than judicial,” the Judge wrote. He later stepped down after allegedly describing the United States as “the enemy”.

Refusing to concede defeat, US authorities pushed back and sought a judicial review of Judge Harvey’s ruling. In a judgment today, the High Court upheld the earlier decision handed down in the North Shore District Court.

Justice Helen Winkelmann dismissed the application for a judicial review, noting that without disclosure of the evidence, Kim Dotcom and his co-accused – Mathias Ortmann, Finn Batato and Bram van der Kolk – would not be able to mount a full and proper defense in their extradition hearing.

“Without disclosure [Kim Dotcom and associates] will be significantly constrained in [their] ability to participate in the hearing, and the requesting state will have a significant advantage in terms of access to information,” the ruling reads.

The documents to be disclosed are significant in their scope, encompassing all elements of the case from the allegations of infringement, through to information being held on the nature of the Megaupload rewards program. Interestingly, as part of a section marked Criminal Breach of Copyright, the ruling says that US authorities must disclose:

– All records obtained or created in connection with the covert operations undertaken by agents involved in the investigations related to these proceedings in transacting and uploading/downloading data and files on the Megaupload site.

– All records or information and/or material provided to or obtained by the investigation and/or prosecuting agencies by the investigating and/or prosecuting agencies in this case from holders and/or owners of copyright interests evidencing alleged infringement of their copyright and/or complaining of such infringement.

- All records and materials related to communications between relevant copyright holders and Megaupload and/or its employees regarding their copyright interest, the direct delete access provided by Megaupload to any such copyright holders, and any communications between the copyright holders and Megaupload and/or its staff regarding take-down notices.

Today’s ruling marks a significant victory for Kim Dotcom, his associates, and their legal team. Access to the evidence against them has been ruled crucial to the defendants being able to mount a proper defense, something that the US authorities have tried to deny. Last week Dotcom promised more revelations – they are now almost certainly on their way.

The extradition hearing is currently expected sometime early 2013.

Posted Image View: Original Article

Federal Judge: Your Location is No More Private Than the Color of Your Car

A court of appeals has ruled that the cops can legally trace the location of your cell phone on public roads -- no warrant required. Can you say Big Brother?

Last January, the US Supreme Court ruled that the police must obtain a warrant before secretly attaching a GPS tracking device to your car, at least for any length of time. The decision in Jones v. United States was heralded as a small victory for those of us who like our gadgets but love our privacy even more.

Yesterday, the US Circuit Court of Appeals for the Sixth Circuit failed to uphold the same kind of privacy protection for cell phones. In United States v. Skinner it ruled that because we all know cell phones have GPS transponders that can broadcast our locations at any time, we have no reasonable expectation of privacy when we carry them.

[Want to Track Someone's Car? More Options Roll Out]

(Disclaimer: I am not a lawyer. And not only am I not a lawyer, but reading legal arguments makes me want to lie down with a cool towel over my head until the throbbing goes away. So take this blog entry with a grain of salt and two Advils, and call an attorney in the morning.)

Ars Technica nicely summarizes the facts of the case. It concerns a dope smuggler named Melvin Skinner (aka “Big Foot”). Old Big Foot was part of a ring of marijuana distributors that used disposable cell phones (aka “burners”) to coordinate their activities (apparently, they too were big fans of The Wire). Big Foot was arrested by the cops at a rest stop in Abilene, Texas, driving a motorhome filled with more than half a ton of marijuana. The cops found him via the location data provided by his cell phone.

The police did obtain legal authority to obtain Bigfoot’s cell phone data – what are known as pen register/trap trace orders. So they could find out who he called and when he called them, but they weren’t able to listen in on his conversations. The legal question was whether his location data fell under the legal definition of “stored communications,” which can be obtained fairly easily by the cops, or if it was a search under the Fourth Amendment, which requires more stringent judicial oversight.

Bigfoot’s lawyers argued that it was a search, and that the cops did not obtain a warrant sufficient to obtain that information. The court ruled it was just data, and thus covered under the trap trace. And since it involved a gadget the suspect was already carrying, there was no trespass on his property, a la Jones v. US.

The majority opinion by Judge John Rogers [PDF] is more than a bit disturbing, however. He wrote:


There is no Fourth Amendment violation because Skinner did not have a reasonable expectation of privacy in the data given off by his voluntarily procured pay-as-you-go cell phone. If a tool used to transport contraband gives off a signal that can be tracked for location, certainly the police can track the signal….

It follows that Skinner had no expectation of privacy in the context of this case, just as the driver of a getaway car has no expectation of privacy in the particular combination of colors of the car’s paint.

In case you missed that, Judge Rogers believes that cell phone location data is no more private than the color of your car. He also goes out of his way to note that “an innocent actor would similarly lack a reasonable expectation of privacy in the inherent external locatability of a tool that he or she bought.” So this doesn’t just apply to alleged drug smugglers; it applies to you and me as well.

Orin Kerr at The Volokh Conspiracy legal blog gets to the essential question: How did the cops obtain that location data, exactly? Did the wireless company that provided the burners periodically record the phone’s location, leaving a trail of breadcrumbs for the cops to follow? Or did the cops tell them to ping it? That would be more like being able to describe the paint on your car from a distance of several hundred miles. Is that something anyone should reasonably expect? I think not.

The question isn’t so much whether Big Foot is guilty; the question is whether the police treated his location data – and by extension, all of ours as well -- with the restraint dictated by the Fourth Amendment.

The way our system works is that if the cops want to violate my personal privacy, they need to a) have a pretty compelling reason, and b) convince a judge their reasons are compelling. If that Sixth District ruling stands, the cops will be able to follow anyone at any time for almost any reason, using the tools we bought and paid for. Does that seem right to you?

Posted Image View: Original Article

Thursday, August 16, 2012


MegaUpload: New Zealand court wants evidence of piracy

  • submit to reddit
Although Kim Dotcom doesn't have to worry about extradition to the US until at least March 2013, the case against the MegaUpload founder which has already seen a number of delays at the ire of the FBI who are desperate to get their hands on him, took yet another twist on Thursday.
The BBC reports that the New Zealand court has ruled that they must see evidence of piracy before Dotcom is extradited to the US. Justice Helen Winklemann said that the defence team needed access to the evidence ahead of the extradition hearing, due next year in March.
Dotcom denies that he copied and distributed music, films and other content on a grand scale. The US authorities have accused Dotcom of copyright theft, money laundering and racketeering fraud and could face a jail stint of up to 20 years if convicted in the US.
Prosecutors further accuse Dotcom of costing copyright holders more than $500m (£322m) in lost earnings, making it one of the biggest cases of its kind.
MegaUpload, one of the biggest file sharing websites, was shut down in January by US law enforcement officials. Dotcom and several other MegaUpload team members were charged at the time with online content piracy. Dotcom has maintained his innocence.
Source: BBC | Image: Associated Press (AP)

World-class cryptos wanted: Researchers seek help decoding "encrypted warhead"

Secret payload in Gauss malware may attack high-profile target a la Stuxnet worm.
Researchers have renewed their call for help in cracking an "encrypted warhead" they believe was unleashed by a powerful nation-state and may be poised to search and destroy a high-profile target.

The mysterious payload is contained in "Gauss," the malware with ties to Stuxnet and Flame that Kaspersky Lab researchers recently found targeting computers in Lebanon and other Middle Eastern countries. The researchers have already tried millions of possible keys to unlock the code, so they are now refocusing their efforts on defeating the cryptography used to conceal the underlying code. They believe the secret code may be designed to disrupt SCADA (supervisory control and data acquisition) systems used to control equipment used by dams, gasoline refineries, and other types of critical infrastructure.

"Of course, it is obvious that it is not feasible to break the encryption with a simple brute-force attack," the researchers wrote in a blog post published Tuesday morning. "We are asking anyone interested in breaking the code and figuring out the mysterious payload to join us."

"The resource section is big enough to contain a Stuxnet-like SCADA targeted attack code and all the precautions used by the authors indicate that the target is indeed high-profile," they added, referring to encrypted payload.

The encrypted file is contained in a Gauss module that attaches itself to USB drives. When plugged in, the malware collects a variety of system information and uses a cryptographic hash of that data as a decryption key. They key is the result of the system data being passed through the MD5 algorithm, with its hash in turn being passed through the same algorithm 10,000 more times, making it infeasible for researchers to deduce the initial value needed to unlock the malicious code. The payload is looking for a program name written in an extended character set, such as Arabic or Hebrew, or one that starts with a special symbol such as “~”.

Researchers believe the mechanism allows Gauss to remain dormant except on a specific system that was targeted in advance. Stuxnet, which was used to disrupt Iran's nuclear program, contained a similar mechanism that targeted computer systems at the Natanz Uranium enrichment facility, although Stuxnet didn't use encryption to conceal its contents.

Kaspersky researchers have released the first 32 bytes of encrypted data and hashes from four Gauss variants in the hopes that a "world-class cryptographer" will be able to decrypt them. Submissions can be sent to theflame@kaspersky.com.

Posted Image View: Original Article

uTorrent Makes Ads Optional Following User ‘Revolt’

BitTorrent Inc, the parent company of uTorrent, is backpedaling on its decision to force advertisements on users of the popular file-sharing client. While the upcoming uTorrent release will still include “sponsored torrents”, users will have the option to turn these off if they don’t wish to see them. In a statement the company stresses that they will continue to experiment with new revenue models to support the development and innovation of file-sharing software.

Posted Image
Last weekend we broke the news that uTorrent will soon become ad-supported.

The ads will come in the form of sponsored torrents through which advertisers can reach uTorrent’s user base of 125 million active users worldwide.

Along with the announcement BitTorrent Inc. asked users to voice their opinions on the decision, and in the days that followed dozens did just that. While these commenters represent a minuscule fraction of the total number of uTorrent users, their feedback was both negative and fairly unanimous.

“An absolute disgrace. uTorrent used to be an excellent lightweight client with some great features, now its just a bloated and buggy piece of crap which is now going to be bundled with adware,” one user said.

“You were great until a short time ago. Now you are just turning into a bloated mess like all the others. Whoever the genius was to think including ads in your pretty GUI would be a good idea should be gently hung with barbed wire,” another added.

Although these sentiments might not necessarily represent those of the majority, it did motivate BitTorrent Inc. to rethink its decision to force ads onto users.

Today, the company announced that they will give users the ability to opt-out of the sponsored torrents when the initial version is released.

“We’ve long contemplated an opt-out mechanism for the new offers and advertisements we will be experimenting with. Given all that’s been said here, we’ve decided to release the initial version with an opt-out mechanism. Users should have the choice to opt-out, and we will provide them with ways to do so,” said BitTorrent CEO Eric Klinker.

According to Klinker it was never their intention to merely cash in on ads. The extra revenue will be used to improve current and future file-sharing technology.

“Opt-in offer experiences also help us bring new levels of investment; not just to the uTorrent client, but also to future iterations of peer-to-peer technology. In other words: experiments like this can help prove to the world that there is a legitimate third way in digital distribution.”

“Experiments like this help us give the distributed technology that we all believe in a fighting chance,” Klinker adds.

BitTorrent Inc has grown explosively in recent years, both in terms of revenue and employees. Current annual revenue is estimated at somewhere between $15 and $20 million and the company is backed by millions in venture capital. By adding sponsored torrents the company will be able to expand even further in the years to come.

This is not the first time that a group of uTorrent users has lashed out against BitTorrent Inc for changes the company made to their flagship software. As is the case for all software, there will always be people who reject change. However, this hasn’t stopped new users from adopting the company’s products.

With its uTorrent and BitTorrent clients the San Francisco company currently has a dominating market share of over 75%, which translates into more than 150 million active users a month. uTorrent has experienced the most spectacular growth by multiplying its active monthly users fivefold to 125 million in less than 4 years.

:view: View: Original Article

Movie Studios Compiled Scary Private Life Dossier On SurfTheChannel Owner

The Hollywood-backed Federation Against Copyright Theft was the driving force behind the four-year jail sentence handed down to former SurfTheChannel owner Anton Vickerman yesterday. The organization conducts its own investigations and then hands its findings to police and other authorities, but just how much can they discover about targets such as Vickerman? Internal FACT documents obtained by TorrentFreak show the anti-piracy group go to scary lengths to delve deep into people’s private lives.

Posted Image
Anton Vickerman, the owner of TV streaming links site SurfTheChannel, was sentenced to four years jail-time at Newcastle Crown Court yesterday after previously being found guilty of conspiracy to defraud for “facilitating” copyright infringement.

The background investigation into the case was carried out by the Hollywood-funded, MPA-affiliated, UK anti-piracy group Federation Against Copyright Theft. FACT has no official powers and is a limited company in the UK, but as this article will reveal it has a surprising level of influence when it comes to obtaining information.

Before being sentenced Vickerman arranged that for his side of the story to be posted on the SurfTheChannel website. In close to 20,000 words he describes the past five years as a “very British miscarriage of justice.” In addition to the story Vickerman also posted an archive containing evidence to back up his claims.

Among other things, the archive contains a FACT document headlined ‘Operation Stemp – Subject Profile: Anton Vickerman’, which is a dossier of information the FACT Intelligence Unit compiled on the SurfTheChannel admin, his family, and his associates.

The document begins by stating that Vickerman is believed to be the operator of two “torrent sites” – surfthechannel.com and snarf-it.org, both of which “sell copyrighted material”. It follows with Vickerman’s home address, notes that his wife lives with him, lists the make, model and license plate of her car, and indicates she was being watched as long ago as May 2008.

According to FACT, Vickerman worked on the famous Suprnova.org torrent site and used several aliases including FD, Shadow, Serious, Casper and Ben Vickerman. But from here things start to get more intimate.

In the next section of the profile FACT conduct a “Financial Analysis” of Vickerman, noting that he had previously defaulted on seven credit agreements.

And then, just when people in the UK might incorrectly presume that their finances are a private affair, FACT notes that Vickerman had two standing loans being paid back at the rate of £209 per month and goes on to describe the details of his mortgage, how much he pays each month, and the fact that he and his wife never missed a payment.

Posted Image

The data gathering continues to include the personal details of Anton Vickerman’s mother and father who are both pensioners.

Kelly Vickerman, Anton’s wife, was described as having two bank accounts and a credit card (with £1,025 outstanding) and an account with the comms provider BT. Initially FACT had considered that an account might have been held with comms provider BSKYB so wrote to the company asking for information – FACT apparently have “an agreement” with BSKYB to obtain information.

Posted Image

BSKYB responded back saying no accounts were held at the Vickerman’s address

Posted Image

As noted earlier, FACT incorrectly described streaming links site SurfTheChannel as a BitTorrent site, but they go even further when justifying the need to conduct surveillance on the Vickermans.

Posted Image

The documents go on to list the reports provided by FACT’s private investigators as they track Vickerman up and down the country during and after his meeting with a movie industry undercover operative in a London hotel. They also list requests to use covert filming techniques when an operative posed as a potential housebuyer. Part of the operative’s report and filming is shown below.

Posted Image

The depth of the investigation and the amount of information obtained by FACT on the Vickermans is quite remarkable. The data and correspondence collated runs to dozens of pages but perhaps what is most noticeable is the manner in which everything is presented. The whole thing looks like a police operation yet it was not – it was an investigation being carried out by a UK company on behalf of other companies in the United States.

But for FACT and their Hollywood paymasters overseas, the effort will have been worth it. Four years in jail for Anton Vickerman is a very aggressive punishment and what could yet prove to be a significant deterrent to others looking to follow in his footsteps. The MPAA will be very pleased with their investment this morning, there can be little doubt about that.

Posted Image View: Original Article

Kim Dotcom: MPAA / RIAA Corrupted the U.S. Government

In a submission to the U.S. Copyright Tzar the MPAA and RIAA characterized Kim Dotcom and his colleagues as manipulative, “wealthy and arrogant.” According to the MegaUpload founder this language is a sign of weakness. “There is no need to sway public opinion because everyone can see how the MPAA and RIAA are corrupting the system by infiltrating their own people into key government positions,” he says.
Posted Image
Last Friday the MPAA and RIAA filed a joint submission with Intellectual Property Enforcement Coordinator Victoria Espinel.

The two groups gave their recommendations for future IP enforcement policy and among other suggestions offered to help out with future international actions against “rogue sites” such as Megaupload.

“In this case, the Justice Department and other federal agencies are now grappling with a set of wealthy and arrogant defendants who are leaving no stone unturned in their efforts to sway public opinion against efforts to hold them accountable,” the groups wrote.

An interesting choice of words.

Ignoring whether or not the statements apply to Dotcom or not, being “wealthy and arrogant” is by no means a crime. In fact, many people in Hollywood and the music business can easily be described using the same terms. In addition, “swaying public opinion” is one of the main goals of both the MPAA and RIAA.

In a response to the name-calling, Megaupload founder Kim Dotcom says the insults are a sign of weakness. According to him there is absolutely no need to “sway anything.”

“They are calling me names because the case against Megaupload is a stillborn cripple,” Dotcom told TorrentFreak.

“There is no need to sway public opinion because everyone can see how the MPAA and RIAA are corrupting the system by infiltrating their own people into key government positions. They are openly paying politicians and hiring public officials who are favorable to them.”

Dotcom is referring to the so-called “revolving door” between the U.S. Government and the copyright industries. As a result, the MPAA and the U.S. authorities prosecuting Megaupload can be considered a close group of friends.

“A recent example is the senior vice president of the MPAA Marc Miller who recently called me a ‘career criminal’ at a press briefing regarding the potential dismissal of the Megaupload case,” Dotcom says.

“He is a former prosecutor and colleague of Jay Prabhu, one of the US Attorneys behind the prosecution of Megaupload. They worked together in the Computer Crime division at the Department of Justice and they jointly won the Anti-Piracy Leadership Award from the SIIA.”

“Good friends help each other,” Dotcom adds.

One of the most crucial employees at the MPAA is its CEO Chris Dodd, who joined the movie industry group in 2011 after serving as a senator for thirty years.

“The MPAA made the ultimate hire with former Senator and Joe Biden’s best friend Chris Dodd. They now own the ear drums at the White House. And Chris Dodd is using his influence,” Dotcom says.

“The US Attorney [Neil MacBride] leading this case was a former copyright lobbyist and lawyer of Joe Biden. He is also a buddy of Chris Dodd. This gang of friends plotted the takedown of Megaupload in bad faith,” Dotcom adds.

As mentioned before, Kim Dotcom and his legal team claim to have evidence that vice president Joe Biden was the one who ordered the shutdown of Megaupload. According to Dotcom the vice president admitted this in public.

“At a recent fundraiser luncheon Joe Biden openly admitted and bragged that he was behind the Megaupload termination. And that he had to convince Barack Obama and Hillary Clinton to back him and Chris Dodd. We have a credible witness who has provided our legal team with evidence.”

Dotcom is convinced that Biden is the mastermind, and that people such as assistant U.S. attorney Jay Prabhu are nothing more than foot soldiers waiting in line to walk through the revolving door.

“Who believes that Jay Prabhu, a semi-talented assistant US Attorney with little respect inside the DOJ has the balls to take down a global cloud storage business with millions of legitimate users and 4% of all Internet traffic? He is just a soldier following orders.”

“And when the Megaupload case finally arrives at the bullshit graveyard Jay Prabhu might get a job at the MPAA just like his former colleague Marc Miller. That is, if the MPAA still exists after Megaupload, it’s business partners and our users sue them and the studios for damages.”

While the entertainment industry and the U.S. Government succeeded in taking Megaupload out, at least temporarily, Dotcom believes that the truth will come out in the end.

“The evidence of corruption is surfacing thanks to whistleblowers. This time they went too far and it’s going to bite them where it hurts,” Dotcom says.

“We are innocent. We can prove it. The legal experts are siding with us. We are winning important court battles. And we have the people of the Internet on our side. The public and the media are becoming more interested in this case, making it increasingly difficult for the US government to get away with lies and dirty tricks.”

Megaupload’s founder already scored a victory in New Zealand, and he believes that more will follow.

“Independent New Zealand judges see right through the politically motivated maliciousness of this case and won’t become an accessory after the fact for big content billionaires in the US,” he says.

According to Dotcom the public has an important role to play in turning this case in favor of Megaupload. Voting Obama out of office is a good start, as he is in the pockets of the MPAA and RIAA.

“Remember the Mr President song? ‘Don’t let them get away with that’. You can start by voting for a new administration in November if Obama isn’t turning this around. Hollywood and the MPAA are only backing Obama’s re-election and can’t expect any favors from Mitt Romney. Romney is simply the better bet for a free Internet.

“You have the power to send a strong message to the next President of the United States. Get involved. Tell your friends. Blog and tweet. Take your Internet back while you still can,” Dotcom concludes.

:view:Original Article: TorrentFreak