• Sc chevron_right

      NSA Buying Bulk Surveillance Data on Americans without a Warrant

      news.movim.eu / Schneier · Monday, 29 January - 20:19

    It finally admitted to buying bulk data on Americans from data brokers, in response to a query by Senator Weyden.

    This is almost certainly illegal, although the NSA maintains that it is legal until it’s told otherwise.

    Some news articles .

    • chevron_right

      How Seized Firesticks in a Plastic Bag Opened Up a Pirate Rabbit Hole

      news.movim.eu / TorrentFreak · Saturday, 6 January - 21:24 · 4 minutes

    binoculars Here at TF we track a lot of lawsuits, not to mention buy, research, and then ultimately report on them. While that can be a lot of work, in the United States detailed information is mostly easy to find.

    The same can’t always be said when piracy-related news is made available by various third-parties, often with a commercial interest in how information is presented. Through selective emphasis, useful information may not even be presented at all.

    As a result, indirect yet open sources of information are increasingly important, not necessarily to report directly in public, but to better understand the bigger picture. Sometimes the bigger picture starts with an actual picture.

    Zoom In. Now Enhance. Enhance Again

    We’ve all seen the memes and subsequent compilations of those memes, so finding yourself in a zooming and enhancing situation can be unintentionally comical, at least initially.

    Last year we reported on a series of raids in the UK against suspected IPTV resellers. With no services named and no clear idea who had been arrested, we reluctantly published the news as provided along with the officially-supplied images below.

    Images from the raids ERSOU-IPTV-Seized1

    A few days later, after being alerted to a failing SSD, a swift check of the data revealed little worth saving; if the SSD died, it died. However, the drive contained a handful of images with one in particular standing out due to a larger-than-usual file size.

    After quickly opening the image in GIMP , the picture of the Firestick boxes in a bag appeared so, given its size, a quick zoom on the label seemed in order. Before the image finally ran out of resolution, it was possible to zoom and enhance nine times. The image below shows the detail at just six.

    Zoom Out. Zoom Out Again

    In itself, an image of Firestick boxes in an evidence bag is nothing unusual. The devices are cheap, functional, and as such are popular among those selling and buying pirate IPTV packages.

    Whether there were any physical devices in these particular boxes is unclear because, on closer inspection, it appears that some of the boxes had been previously opened. The evidence label also mentions ‘4x Fire TV Stick’ but for some reason, the word ‘boxes’ was written on another line.

    For those wondering why that might be important, it probably isn’t. The fact that GIMP indicated that the image had previously been rotated is very important, however.

    GIMP was able to determine that fact due to the image’s EXIF data , a collection of metadata tags embedded in a file that can show anything from shutter speed and exposure compensation, to whether a flash was used or not. All of this data should’ve been stripped before the images were published online.

    EXIF Data Jackpot

    EXIF data can be extracted with a number of tools but in this case, FOCA was to hand and it always does a great job. According to the data, the Firestick photo was taken on a Samsung S21 smartphone (SM-G998B) at 07:44 and 16 seconds on the day of the raid. The metadata also confirmed (orientation: Right side. top (Rotate 90 CW) that the image had indeed been rotated.

    Image metadata, also not stripped before being made available to the public, included GPS coordinates. This information is usually accurate to about five meters and revealed where the photo was taken.

    The coordinates reveal that both photographs were taken at the same address in an area of London, not far from an area previously mentioned in connection with the case; although not exactly the same area according to a pair of helpful tools.

    Distort. Mirror. Blur. Rotate. Flip zoom-enhance-flip

    Thanks to Google Maps and Google Street View, identifying addresses and cross-referencing with other public data sources referencing people and sometimes historical events, building a bigger picture can be time-consuming. Frequently, however, it’s worth the effort.

    Don’t Take Data For Granted

    While the GPS coordinates in any image can be useful, they also have the potential to mislead or, in fringe cases, may have even been tampered with. Taking this case as an example, just because the photograph was taken inside a particular address, it doesn’t necessarily follow that the items were actually seized from inside that address.

    We’re unable to commit the resources to prove one way or the other, but these devices may have been retrieved from a vehicle, rather than bricks and mortar.

    While not necessarily used or useful in this case, other items in images like these can at times prove helpful. With carpet clearly visible, that has the potential be matched to an address. Since knocking on the door and asking to look around might not be well received, the property may have been sold recently. If so, an estate agent has probably photographed the entire house and left the listing online.

    Finally, feel free to freak yourself out with GeoSpy AI , an online tool which tries to identify the location of photographs taken outside, even with metadata stripped. It can be hit-and-miss depending on image and location but when it gets it right, it does so with startling accuracy.

    TorrentFreak previously notified the source of both photographs that metadata hadn’t been stripped

    From: TF , for the latest news on copyright battles, piracy and more.

    • Sc chevron_right

      Spying through Push Notifications

      news.movim.eu / Schneier · Wednesday, 6 December - 19:46 · 1 minute

    When you get a push notification on your Apple or Google phone, those notifications go through Apple and Google servers. Which means that those companies can spy on them—either for their own reasons or in response to government demands.

    Sen. Wyden is trying to get to the bottom of this :

    In a statement, Apple said that Wyden’s letter gave them the opening they needed to share more details with the public about how governments monitored push notifications.

    “In this case, the federal government prohibited us from sharing any information,” the company said in a statement. “Now that this method has become public we are updating our transparency reporting to detail these kinds of requests.”

    Google said that it shared Wyden’s “commitment to keeping users informed about these requests.”

    The Department of Justice did not return messages seeking comment on the push notification surveillance or whether it had prevented Apple of Google from talking about it.

    Wyden’s letter cited a “tip” as the source of the information about the surveillance. His staff did not elaborate on the tip, but a source familiar with the matter confirmed that both foreign and U.S. government agencies have been asking Apple and Google for metadata related to push notifications to, for example, help tie anonymous users of messaging apps to specific Apple or Google accounts.