No more Google Analytics
I have removed the GA tracking code from this website. cfenollosa.com does not use any tracking technique, neither with cookies, nor js, nor image pixels.
Even though this was one of the first sites to actually implement a consent-based GA tracking, the current situation with the cookie banners is terrible.
We are back to the flash era where every site had a "home page" and you needed to perform some extra clicks to view the actual content. Now those extra clicks are spent in disabling all the tracking code.
I hate the current situation so much that I just couldn't be a part of it any more. So, no banner, no cookies, no js, nothing. Any little traffic I get I'll analyze with a log parser like webalizer. I wasn't checking it anyways.
Mass cellphone surveillance experiment in Spain
Spanish Statistics Institute will track all cellphones for eight days (2 min, link in Spanish, via)
A few facts first:
- Carriers geotrack all users by default, using cell tower triangulation. They also store logs of your calls and sms, but that is a story for another day.
- This data is anonymized and sold to third parties constantly, it's part of the carriers business model
- With a court order, this data can be used to identify and track an individual...
- ... which means that it is stored de-anonymized in the carrier servers
- This has nothing to do with Facebook, Google or Apple tracking with cookies or apps
- You cannot disable it with software, it is done at a hardware level. If you have any kind of phone, even a dumbphone, you are being tracked
- It is unclear whether enabling airplane mode stops this tracking. The only way to make sure is to remove the SIM card and battery from the phone.
This is news because it's not a business deal but rather a collaboration between Spain's National Statistics Institute and all Spanish carriers, and because it's run at a large scale. But, as I said above, this is not technically novel.
On paper, and also thinking as a scientist, it sounds very interesting. The actual experiment consists on tracking most Spanish phones for eight days in order to learn about holiday trips. With the results, the Government expects to improve public services and infrastructures during holiday season.
The agreement indicates that no personally identifiable data will be transferred to the INE, and I truly believe that. There is nothing wrong about using aggregated data to improve public services per se, but I am concerned about two things.
First of all, Spain is a country where Congress passed a law to create political profiles of citizens by scraping social networks —fortunately rejected by the Supreme Court— and also blocked the entire IPFS gateway to silence political dissent.
I'd say it is quite reasonable to be a bit suspicious of the use that the Institutions will make of our data. This is just a first warning for Spanish citizens: if there is no strong backlash, the next experiment will maybe work with some personal identifiable data, "just to improve the accuracy of results". And yada yada yada, slippery slope, we end up tracking individuals in the open.
Second, and most important. This is no longer a topic of debate! We reached a compromise a few years ago, and the key word is consent.
All scientists have to obtain an informed and specific consent to work with personal data, even if it is anonymous, because it is trivially easy to de-anonymize individuals when you cross-reference the anonymous data with known data: credit cards, public cameras, public check-ins, etc. In this case, once again, the Spanish institutions are above the law, and also above what is ethically correct.
No consent, no data shared, end of story. Nobody consented to this nor were we given an option to opt out.
P.S. Of course, this is a breach of GDPR, but nobody cares.
checkm8: What you need to know to keep your iPhone safe
A couple days ago, Twitter user axi0mX introduced checkm8, a permanent unpatchable bootrom exploit for iPhones 4S to X
The jailbreak community celebrated this great achievement, the netsec community was astounded at the scope of this exploit, and regular users worried what this meant for their phone's security.
Even though I've jailbroken my iPhone in the past, I have no interest to do it now. If you want to read the implications for the jailbreak community, join the party on /r/jailbreak
I have been reading articles on the topic to understand what are the implications for regular people's security and privacy. All my family has A9 iPhones which are exploitable, and I wanted to know whether our data was at risk and, if such, what could we do to mitigate attacks.
I think the best way to present the findings is with a FAQ so people can understand what's going on.
1-Line TL;DR
If you have an iPhone 4s, 5, or 5c, somebody who has physical access to your phone can get all the data inside it. If your phone is more modern and the attacker doesn't know your password, they can still install malware, but rebooting your phone makes it safe again.
What is Jailbreak?
Your iPhone is controlled by Apple. You own it, but you are limited in what you can do with it.
Some people like this approach, others prefer to have total control of their phone.
A jailbreak is a way of breaking these limitations so you can 100% control what's running on your phone.
The goal of jailbreaking is not necessarily malicious. In fact, the term "jailbreak" has the connotation that the user is doing it willingly.
However, the existence of a jailbreak method means that an attacker could use this same technique to compromise your phone. Therefore, you must understand what is going on and how to protect yourself from these attackers.
Jailbreaking has existed since the first iPhone. Why is this one different?
Typically, jailbreaking methods exploit a software bug. This means that Apple can (and does) fix that bug in the next software release, negating the method and any related security issues.
This method, however, exploits a hardware bug on the bootrom. The bootrom is a physical chip in your iPhone that has some commands literally hard-wired in the chip. Apple cannot fix the bug without replacing the chip, which is unfeasible.
Therefore, it is not possible to fix this bug, and it will live with your phone until you replace it
These kind of bugs are very rare. This exact one has been already patched on recent phones (XS and above) and it has been a long time since the last one was found.
☑ This bug is extremely rare and that is why it's important to know the consequences.
How can an attacker exploit this bug? Can I be affected by it without my knowledge?
This exploit requires an attacker to connect your phone to a computer via Lightning cable.
It cannot be triggered by visiting a website, receiving an email, installing an app, or any non-suspicious action.
☑ If your phone never leaves your sight, you are safe.
I left my phone somewhere out of sight. May it be compromised?
Yes. However, if you reboot your phone, it goes back to safety. Any exploit does not persist upon reboots, at least, at this point in time. If that changes, this text will be updated to reflect that.
Any virus or attack vector will be uninstalled or disabled by Apple's usual protections after a reboot.
If you feel that you are targeted by a resourceful attacker, read below "Is there a feasible way to persist the malware upon reboot?"
☑ If you are not sure about the safety of your phone, reboot it.
Can my personal data be accessed if an attacker gets physical access to my phone?
For iPhones 4S, 5 and 5c, your data may be accessed regardless of your password. For iPhones 5s and above (6, 6s, SE, 7, 8, X), your data is safe as long as you have a strong password.
If you have an iPhone 4s, 5, or 5c, anybody with physical access to your phone will have access to its contents if your password is weak (4 to 8 digit PIN code, or less than 8 characters alphanumeric code)
If your iPhone 4s-5-5c has a strong password, and the attacker does not know it and cannot guess it, they may need a long time (months to years) to extract the data. Therefore this attack cannot be run in the scenario where the phone leaves your sight for a few minutes, but you get it back quickly afterwards. However, if your phone 4s-5-5c is stolen, assume that your data is compromised.
It is unknown if this exploit allows the attacker to guess your password quicker than a "months to years" period on older iPhones.
iPhones 5s and above have a separate chip called the Secure Enclave which manages access to your personal data. Your data is encrypted on the device and can not be accessed. The Secure Enclave does not know your password, but uses some math to decrypt it with your password.
If you have an iPhone 5s and above, an attacker can only access your data if they know, or can easily guess, your password.
☑ Use a strong password (>8 alphanumeric characters) that an attacker can not guess
Can it be used to disable iCloud lock, and therefore re-use stolen phones?
It is unknown at this point.
Assuming the scenario where iCloud lock is not broken, and the Secure Enclave is not affected, what is the worst that can happen to my phone?
You may suffer a phishing attack: they install a fake login screen on your iPhone, or replace the OS with an exact copy that works as expected, but it also sends all your keystrokes and data to the attacker.
The fake environment may be indistinguishable from the real one. If you are not aware of this attack, you will fall for it.
Fortunately, this malware will be purged or disabled upon reboot.
All phones (4s to X) are vulnerable to this attack.
☑ Always reboot your phone if you think it may be compromised.
Is there a feasible way to persist the malware upon reboot?
Unlikely. The jailbreak is tethered, which means that the phone must be connected to a computer every time it boots.
However, somebody may develop a tiny device that connects to the Lightning port of the iPhone and conveniently injects code/malware every time it is rebooted.
This device may be used on purpose by jailbreakers, for convenience (i.e. a Lightning-USB key, or a small computer) or inadvertently installed by a sophisticated attacker (i.e. a phone case that by-passes the lightning port without the victim knowing)
In most cases, this external device will be easy to spot even to the untrained eye.
An extremely sophisticated attacker may develop a custom chip that is connected internally to the Lightning port of the iPhone and runs the malware automatically and invisibly. To do so, they would need physical access to your phone for around 10 minutes, the time it takes to open the phone, solder the new chip, and close it again.
☑ Watch out for unexpected devices connected to your Lightning port
Who are these "attackers" you talk about?
Three-letter agencies (NSA, FBI, KGB, Mossad...) and also private companies who research their own exploits (Cellebrite, Greyshift) to sell them to the former.
It is entirely possible that the above already knew about this exploit, however.
Other attackers may be regular thieves, crackers, pranksters, or anybody interested in developing a virus for the iPhone.
If you are a regular user who is not the target of a Government or Big Criminal, remember:
- Don't let people connect your iPhone to an untrusted device
- Otherwise, reboot it when you get it back
- Watch out for small devices on your Lightning port
References:
- Announcement on /r/jailbreak
- Discussion on /r/apple
- Developer of checkm8 answers questions on ArsTechnica
- Discussion of the interview on HN
- Discussion of the interview on /r/apple
Terrifying iPhone implant spreads just by visiting a website
A very deep dive into iOS Exploit chains found in the wild (via) is a terrifying read of an iPhone implant that installs itself just by visiting a website and exploits five different 0-day vulnerabilities.
The implant phones back home with root access to all activity on your phone: chats, mails, location, pictures, and more.
I think it is fair to criticize Apple because they allowed an unsigned process running as root, using the network and a lot of battery activity, without any kind of monitoring to detect it. That process should not have been running without being discovered.
Given that an iPhone is not a computer, and not even an advanced user could detect and/or clean the implant, Apple's responsibility should be to start being more serious about the possibility of iPhone viruses.
An awesome feat of engineering, though. Kudos to both the criminals and the researchers who detected it.
Vice has a non-geek writeup which, at first, seemed like a bit sensationalist, but given the severity of the breach is probably somewhat warranted.
Three take aways to understand Cloudflare's apocalyptic-proportions mess
It turns out that Cloudflare's proxies have been dumping uninitialized memory that contains plain HTTPS content for an indeterminate amount of time. If you're not familiar with the topic, let me summarize it: this is the worst crypto news in the last 10 years.
As usual, I suggest you read the HN comments to understand the scandalous magnitude of the bug.
If you don't see this as a news-opening piece on TV it only confirms that journalists know nothing about tech.
How bad is it, really? Let's see
I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full HTTPS requests, client IP addresses, full responses, cookies, passwords, keys, data, everything
If the bad guys didn't find the bug before Tavis, you may be on the clear. However, as usual in crypto, you must assume that any data you submitted through a Cloudflare HTTPS proxy has been compromised.
Three take aways
A first take away, crypto may be mathematically perfect but humans err and the implementations are not. Just because something is using strong crypto doesn't mean it's immune to bugs.
A second take away, MITMing the entire Internet doesn't sound so compelling when you put it that way. Sorry to be that guy, but this only confirms that the centralization of the Internet by big companies is a bad idea.
A third take away, change all your passwords. Yep. It's really that bad. Your passwords and private requests may be stored somewhere, on a proxy or on a malicious actor's servers.
Well, at least change your banking ones, important services like email, and master passwords on password managers -- you're using one, right? RIGHT?
You can't get back any personal info that got leaked but at least you can try to minimize the aftershock.
Update: here is a provisional list of affected services.
Download the full list, export your password manager data
into a csv file, and compare both files by using grep -f sorted_unique_cf.txt your_passwords.csv.
Afterwards, check the list of potentially affected iOS apps
Let me conclude by saying that unless you were the victim of a targeted attack it's improbable that this bug is going to affect you at all. However, that small probability is still there. Your private information may be cached somewhere or stored on a hacker's server, waiting to be organized and leaked with a flashy slogan.
I'm really sorry about the overly dramatic post, but this time it's for real.
Tags: security, internet, news
Basic iPhone security for regular people
Real life requires a balance between convenience and security. You might not be a high-profile person, but we all have personal information on our phones which can give us a headache if it falls into the wrong hands.
Here are some options you can enable to harden your iPhone in the case of theft, a targeted attack or just a curious nephew who's messing with your phone.
Even if you don't enable them all, it's always nice to know that these features exist to protect your personal information. This guide is specific for iPhones, but I suppose that most of them can be directly applied to other phones.
Password-protect your phone
Your iPhone must always have a password. Otherwise, anybody with physical access to your phone will get access to all your information: calendar, mail, pictures or *gasp* browser history.
Passwords are inconvenient. However, even a simple 4-digit code will stop casual attackers, though it is not secure against a resourceful attacker
☑ Use a password on your phone: Settings > Touch ID & Passcode
Furthermore, enable the 10-attempt limit, so that people can't brute-force your password.
☑ Erase data after 10 attempts: Settings > Touch ID & Passcode > Erase data (ON)
If your phone has Touch ID, enable it, and use a very long and complicated password to unlock your phone. You will only need to input it on boot and for a few options. It is reasonably secure and has few drawbacks for most users. Unless you have specific reasons not to do it, just go and enable Touch ID.
☑ Enable Touch ID: Settings > Touch ID & Passcode
Regarding password input, and especially if your phone doesn't have Touch ID, using a numeric keyboard is much faster than the QWERTY one. Here's a trick that will help you choose a secure numeric password which is easy to remember.
Think of a word and convert it to numbers as if you were dialing them on a phone, i.e. ABC -> 2, DEF -> 3, ..., WYZ -> 9. For example, if your password is "PASSWORD", the numeric code would be 72779673.
The iPhone will automatically detect that the password contains only numbers and will present a digital keyboard on the lock screen instead of a QWERTY one, making it super easy to remember and type while still keeping a high level of security.
☑ If you must use a numeric password, use a long one: Settings > Touch ID & Passcode
Harden your iPhone when locked
A locked phone can still leak private data. Accessing Siri, the calendar or messages from the lock screen is handy, but depending on your personal case, can give too much information to a thief or attacker.
Siri is a great source of data leaks, and I recommend that you disable it when your phone is locked. It will essentially squeal your personal info, your contacts, tasks or events. A thief can easily know everything about you or harass your family if they get a hand on a phone with Siri enabled on the lock screen.
This setting does not disable Siri completely; it just requires the phone to be unlocked for Siri to work.
☑ Disable Siri when phone is locked: Settings > Touch ID & Passcode > Siri
If you have confidential data on your calendar, you may also want to disable the "today" view which usually includes your calendar, reminders, etc.
☑ Disable Today view: Settings > Touch ID & Passcode > Today
Take a look at the other options there. You may want to turn off the notifications view, or the option to reply with a message. An attacker may spoof your identity by answering messages while the phone is locked, for example, taking advantage from an SMS from "Mom" and tricking her into asking for her maiden name, pet names, etc., which are usually answers to secret questions to recover your password.
☑ Disallow message replies when the phone is locked: Settings > Touch ID & Passcode > Reply with Message
Having your medical information on the emergency screen has pros and cons. Since I don't have any dangerous conditions, I disable it. Your case may be different.
Someone with your phone can use Medical ID to get your name and picture, which may be googled for identity theft or sending you phishing emails. Your name can also be searched for public records or DNS whois information, which may disclose your home phone, address, date of birth, ID number and family members.
In summary, make it sure that somebody who finds your locked phone cannot discover who you are or interact as if they were you.
☑ Disable Medical ID: Health > Medical ID > Edit > Show When Locked
Some people think that letting anyone find out the owner of the phone is a good idea, since an honest person who finds your lost phone can easily contact you. However, you can always display a personalized message on your lock screen if you report your phone missing on iCloud.
☑ Enable "Find my phone": Settings > iCloud > Find my iPhone > Find My iPhone
Make sure that your phone will send its location just before it runs out of battery
☑ Enable "Find my phone": Settings > iCloud > Find my iPhone > Send Last Location
To finish this section, if you don't have the habit of manually locking your phone after you use it, or before placing it in your pocket, configure your iPhone to do it automatically:
☑ Enable phone locking: Settings > General > Auto-Lock
Harden the hardware
Your phone is now secure and won't sing like a canary when it gets into the wrong hands.
However, your SIM card may. SIMs can contain personal information, like names, phones or addresses, so they must be secured, too.
Enable the SIM lock so that, on boot, it will ask for a 4-digit code besides your phone password. It may sound annoying, but it isn't. It's just an extra step that you only need to perform once every many days, when your phone restarts.
Otherwise, a thief can stick the SIM in another phone and access that information and discover your phone number. With it, you may be googled, or they may attempt phishing attacks weeks later.
Beware that this strategy doesn't allow the phone to ping home after it has been shut down and turned on.
☑ Enable SIM PIN: Settings > Phone > SIM PIN
Enable iCloud. When your phone is associated with an iCloud account, it is impossible for another person to use it, dropping its resale value to almost zero. I've had some friends get their phones back after a casual thief tried to sell them unsuccessfully thanks to the iCloud lock and finally decided to do the good thing and return it.
☑ Enable iCloud: Settings > iCloud
If you have the means, try to upgrade to an iPhone 5S or higher. These phones contain a hardware element called Secure Enclave which encrypts your personal information in a way that can't even be cracked by the FBI. If your phone gets stolen by a professional, they won't be able to solder the flash memory into another device and recover your data.
☑ Upgrade to a phone with a Secure Enclave (iPhone 5S or higher)
Harden your online accounts
In reality, your online data is much more at risk than your physical phone. Botnets constantly try to find vulnerabilities in services and steal user passwords.
The first thing you must do right now is to install a password manager. Your iPhone has one built into the system, which is good enough to generate unique password and auto-fill them when needed.
If you don't like Apple's Keychain, I recommend LastPass and 1Password.
Why do you need a password manager? The main reason is to avoid having a single password for all services. The popular trick of having a weak password for most sites and another strong password for important sites is a dangerous idea.
Your goal is to have a different password for each site/service, so that if it gets attacked or you inadvertently leak it to a phishing attack, it is no big deal and doesn't affect all your accounts.
Just have a different one for each service and let the phone remember all of them. I don't know my passwords: Gmail, Facebook, Twitter, my browser remembers them for me.
☑ Use a password manager: Settings > iCloud > Keychain > iCloud Keychain
There is another system which complements passwords, called "Two-Factor Authentication", or 2FA. You have probably used it in online banking; they send you an SMS with a confirmation code that you have to enter somewhere.
If your password gets stolen, 2FA is a fantastic barrier against an attacker. Without your phone, they can't access your data, even if they have all your passwords.
☑ Use 2FA for your online accounts: manual for different sites
2FA makes it critical to disable SMS previews, because if a thief steals your phone and already has some of your passwords, he can use your locked phone to read 2FA SMS.
If you use iMessage heavily, this may be cumbersome, so decide for yourself.
☑ Disable SMS previews on locked phone: Settings > Notifications > Messages > Show Previews
Make it easy to recover your data
If the worst happens, and you lose your phone, get it stolen or drop it on the Venice canals, plan ahead so that the only loss is the money for a new phone. You don't want to lose your pictures, passwords, phone numbers, events...
Fortunately, iPhones have a phenomenal backup system which can store your phone data in the cloud or your Mac. I have a Mac, but I recommend the iCloud backup nonetheless.
Apple only offers 5 GB of storage in iCloud, which is poor, but fortunately, the pricing tiers are fair. For one or two bucks a month, depending on your usage, you can buy the cheapest and most important digital insurance to keep all your data and pictures safe.
iCloud backup can automatically set up a new phone and make it behave exactly like your old phone.
If you own a Mac, once you pay for iCloud storage,
you can enable the "iCloud Photo Library" on Settings > iCloud > Photos >
iCloud Photo Library for transparent syncing of all your pictures between your phone and your computer.
☑ Enable iCloud backup: Settings > iCloud > Backup > iCloud Backup
If you don't want the iCloud backup, at least add a free iCloud account or any other "sync" account like Google's, and use it to store your contacts, calendars, notes and Keychain.
☑ Enable iCloud: Settings > iCloud
Bonus: disable your phone when showing pictures
Afraid of handing your phone over to show somebody a picture? People have a tendency to swipe around to see other images, which may be a bad idea in some cases.
To save them from seeing things that can't be unseen, you can use a trick with the Guided Access feature to lock all input to the phone, yet still show whatever is on the screen.
☑ Use Guided Access to lock pictures on screen: Read this manual
This is not a thorough guide
As the title mentions, this is an essential blueprint for iPhone users who are not a serious target for digital theft. High-profile people need to take many more steps to secure their data. Still, they all implement these options too.
The usual scenario for a thief who steals your phone at a bar is as follows: they will turn it off or put it in airplane mode and try to unlock it. Once they see that it's locked with iCloud, they can either try to sell it for parts, return it or discard it.
Muggers don't want your data. However, it doesn't hurt to implement some security measures.
In worse scenarios, there are criminal companies specialized in buying stolen phones at a very low price and perform massive simple attacks to unsuspecting users to trick them into unlocking the phone or giving up personal data.
You don't need the same security as Obama or Snowden. Nonetheless, knowing how your phone leaks personal information and the possible attack vectors is important in defending yourself from prying eyes.
You have your whole life on your phone. In the case of an unfortunate theft, make it so the only loss is the cost of a new one.
Tags: security