Joseph Cox, reporting at Vice's Motherboard: One user travelled through a park a few blocks south of an Islamic cultural center. Roughly every two minutes, their phone reported their physical location. Another was next to a bank two streets over from a different mosque. A third person was at a train station, again near a mosque. Perhaps unbeknownst to these people, Salaat First (Prayer Times), an app that reminds Muslims when to pray, was recording and selling their granular location information to a data broker, which in turn sells location data to other clients. Motherboard has obtained a large dataset of those raw, precise movements of users of the app from a source. The source who provided the dataset was concerned that such sensitive information, which could potentially track Muslims going about their day including visiting places of worship, could be abused by those who buy and make use of the data. The company collecting the location data, a French firm called Predicio, has previously been linked to a supply chain of data involving a U.S. government contractor that worked with ICE, Customs and Border Protection, and the FBI.

The news about Salaat First, which has been downloaded more than 10 million times on Android, highlights not only the use of religious apps to harvest location data, but also the ease at which this sensitive information is traded in the location data industry. Motherboard is withholding some specifics about the dataset such as its exact size in order to protect the source, but the significance is clear: users of a Muslim-focused app are being tracked likely without their informed consent. "Being tracked all day provides a lot of information, and it shouldn't be usable against you, especially if you are unaware of it," the source said. Motherboard granted them anonymity to avoid repercussions from their employer.

The Turkish Competition Board said on Monday it launched an investigation into WhatsApp and its owner Facebook after the messaging app asked users to agree to let Facebook collect user data including phone numbers and locations. From a report: In a written statement, the Competition Board said it ruled the data-collection requirement should be suspended until the probe is complete. "The Competition Board has opened an investigation into Facebook and WhatsApp and suspended the requirement to share Whatsapp data," it said. WhatsApp updated its terms of service last Wednesday, allowing Facebook and its subsidiaries to collect user data. The deadline for agreeing to the new terms is Feb. 8.

The Associated Press reports: New Zealand's central bank said Sunday that one of its data systems has been breached by an unidentified hacker who potentially accessed commercially and personally sensitive information. A third party file sharing service used by the Reserve Bank of New Zealand to share and store sensitive information had been illegally accessed, the Wellington-based bank said in a statement.

Governor Adrian Orr said the breach has been contained. The bank's core functions "remain sound and operational," he said... "The nature and extent of information that has been potentially accessed is still being determined, but it may include some commercially and personally sensitive information," Orr added...

Dave Parry, professor of computer science at Auckland University, told Radio New Zealand that another government was likely behind the bank data breach. "Ultimately if you were coming from a sort of like criminal perspective, the government agencies aren't going to pay your ransom or whatever, so you'd be more interested probably coming in from a government-to-government level," Parry said.

"It might be easier at this point to ask which tech platforms President Donald Trump can still use," jokes TechCrunch.

The Wall Street Journal reports: Stripe Inc. will no longer process payments for President Trump's campaign website following last week's riot at the Capitol, according to people familiar with the matter.

The financial-technology company handles card payments for millions of online businesses and e-commerce platforms, including Mr. Trump's campaign website and online fundraising apparatus. Stripe is cutting off the president's campaign account for violating its policies against encouraging violence, the people said...

Stripe asks users to agree that they won't accept payments for "high risk" activities, including for any business or organization that "engages in, encourages, promotes or celebrates unlawful violence or physical harm to persons or property," according to its website.
TechCrunch fills in the rest of the story. "Sources told the Journal that the reason for the company's decision was the violation of company policies against encouraging violence....

"The deplatforming of the president has effectively removed Trump from all social media outlets including Snap, Facebook, Twitter, Pinterest, Spotify and TikTok."

CNN reports: When President Donald Trump signed the $2.3 trillion coronavirus relief and government funding bill into law in December, so began the 180-day countdown for US intelligence agencies to tell Congress what they know about UFOs.

No, really.

The director of National Intelligence and the secretary of defense have a little less than six months now to provide the congressional intelligence and armed services committees with an unclassified report about "unidentified aerial phenomena." It's a stipulation that was tucked into the "committee comment" section of the Intelligence Authorization Act for Fiscal Year 2021, which was contained in the massive spending bill. That report must contain detailed analyses of UFO data and intelligence collected by the Office of Naval Intelligence, the Unidentified Aerial Phenomena Task Force and the FBI, according to the Senate intelligence committee's directive...

A spokesperson for the Office of the Director of National Intelligence confirmed the news to the fact-checking website Snopes.

EFF special consultant/blogger/science fiction writer Cory Doctorow warns in Locus magazine about the dangers of what Bruce Schneier calls "feudal security": Here in the 21st century, we are beset by all manner of digital bandits, from identity thieves, to stalkers, to corporate and government spies, to harassers... To be safe, then, you have to ally yourself with a warlord. Apple, Google, Facebook, Microsoft, and a few others have built massive fortresses bristling with defenses, whose parapets are stalked by the most ferocious cybermercenaries money can buy, and they will defend you from every attacker — except for their employers. If the warlord turns on you, you're defenseless.

We see this dynamic playing out with all of our modern warlords. Google is tweaking Chrome, its dominant browser, to block commercial surveillance, but not Google's own commercial surveillance. Google will do its level best to block scumbag marketers from tracking you on the web, but if a marketer pays Google, and convinces Google's gatekeepers that it is not a scumbag, Google will allow them to spy on you. If you don't mind being spied on by Google, and if you trust Google to decide who's a scumbag and who isn't, this is great. But if you and Google disagree on what constitutes scumbaggery, you will lose, thanks, in part, to other changes to Chrome that make it much harder to block the ads that Chrome lets through.

Over in Facebook land, this dynamic is a little easier to see. After the Cambridge Analytica scandal, Facebook tightened up who could buy Facebook's surveillance data about you and what they could do with it. Then, in the runup to the 2020 US elections, Facebook went further, instituting policies intended to prevent paid political disinformation campaigns at a critical juncture. But Facebook isn't doing a very good job of defending its users from the bandits. It's a bad (or possibly inattentive, or indifferent, or overstretched) warlord, though...

Back to Apple. In 2017, Apple removed all effective privacy tools from the Chinese version of the iPhone/iPad App Store, at the behest of the Chinese government. The Chinese government wanted to spy on Apple customers in China, and so it ordered Apple to facilitate this surveillance... If Apple chose not to comply with the Chinese order, it would either have to risk fines against its Chinese subsidiary and possible criminal proceedings against its Chinese staff, or pull out of China and risk having its digital services blocked by China's Great Firewall, and its Chinese manufacturing subcontractors could be ordered to sever their relations with Apple. In other words, the cost of noncompliance with the order is high, so high that Apple decided that putting its customers at risk was an acceptable alternative.

Therein lies the problem with trusting warlords to keep you safe: they have priorities that aren't your priorities, and when there's a life-or-death crisis that requires them to choose between your survival and their own, they will throw you to the bandits...
"The fact that Apple devices are designed to prevent users from overriding the company's veto over their computing makes it inevitable that some government will demand that this veto be exercised in their favor..." Doctorow concludes. "As with feudal aristocrats, the state is happy to lend these warlords their legitimacy, in exchange for the power to militarize the aristocrat's holdings... "

His proposed solution? What if Google didn't collect or retain so much user data in the first place -- or gave its users the power to turn off data-collection and data-retention altogether? And "What if Apple — by design — made is possible for users to override its killswitches?"

On Friday, America's Cybersecurity and Infrastructure Security Agency revealed that the "threat actor" behind the massive breach of U.S. networks through compromised SolarWinds software also used password guessing and password spraying attacks, according to ZDNet.

And they may still be breaching federal networks, reports GCN: "Specifically, we are investigating incidents in which activity indicating abuse of Security Assertion Markup Language (SAML) tokens consistent with this adversary's behavior is present, yet where impacted SolarWinds instances have not been identified," according to updated guidance published Jan 6. "CISA is continuing to work to confirm initial access vectors and identify any changes to the tactics, techniques, and procedures (TTPs)." SAML tokens having a 24-hour validity period or not containing multi-factor authentication details where expected are examples of these red flags.

As more about the SolarWinds Orion breach has surfaced, analysts and lawmakers have repeatedly commented on how difficult it will be to remove hackers from the government's networks because their access is probably no longer predicated on flaws in SolarWinds Orion, an IT management software. CISA's new guidance appears to confirm that suspicion, stating Microsoft, which is helping the federal government investigate the hack, reported the hackers are tampering with the trust protocols in Azure/Microsoft 365.

"Microsoft reported that the actor has added new federation trusts to existing on premises infrastructure," according to the agency's guidance. "Where this technique is used, it is possible that authentication can occur outside of an organization's known infrastructure and may not be visible to the legitimate system owner." In cases where administrative level credentials were compromised, organizations should conduct a "full reconstruction of identity and trust services," CISA said.

Microsoft published a query to help identify this type of activity.

Writing in the Atlantic, programmer/economics commentator Steve Randy Waldman explains "Why I changed my mind" about the Communication Decency Act's Section 230: In the United States, you are free to speak, but you are not free of responsibility for what you say. If your speech is defamatory, you can be sued. If you are a publisher, you can be sued for the speech you pass along. But online services such as Facebook and Twitter can pass along almost anything, with almost no legal accountability, thanks to a law known as Section 230.

President Donald Trump has been pressuring Congress to repeal the law, which he blames for allowing Twitter to put warning labels on his tweets. But the real problem with Section 230, which I used to strongly support, is the kind of internet it has enabled. The law lets large sites benefit from network effects (I'm on Facebook because my friends are on Facebook) while shifting the costs of scale, like shoddy moderation and homogenized communities, to users and society at large. That's a bad deal. Congress should revise Section 230 — just not for the reasons the president and his supporters have identified.

When the law was enacted in 1996, the possibility that monopolies could emerge on the internet seemed ludicrous. But the facts have changed, and now so must our minds... By creating the conditions under which we are all herded into the same virtual space, Section 230 helped turn the internet into a conformity machine. We regulate one another's speech through shame or abuse, but we have nowhere to go where our own expression might be more tolerable. And while Section 230 immunizes providers from legal liability, it turns those providers into agents of such concentrated influence that they are objects of constant political concern. When the Facebook founder Mark Zuckerberg and the Twitter founder Jack Dorsey are routinely (and justifiably!) browbeaten before Congress, it's hard to claim that Section 230 has insulated the public sphere from government interference...

If made liable for posts flagged as defamatory or unlawful, mass-market platforms including Facebook and Twitter would likely switch to a policy of taking down those posts automatically.... Vigorous argument and provocative content would migrate to sites where people take responsibility for their own speech, or to forums whose operators devote attention and judgment to the conversations they host. The result would be a higher-quality, less consolidated, and ultimately freer public square.

"Both local police and the FBI are seeking information about individuals who were 'actively instigating violence' in Washington, DC, on January 6," writes Ars Technica.

Then they speculate on which tools will be used to find them: While media organizations took thousands of photos police can use, they also have more advanced technologies at their disposal to identify participants, following what several other agencies have done in recent months... In November, The Washington Post reported that investigators from 14 local and federal agencies in the DC area have used a powerful facial recognition system more than 12,000 times since 2019.

Neither would an agency need actual photos or footage to track down any mob participant who was carrying a mobile phone. Law enforcement agencies have also developed a habit in recent years of using so-called geofence warrants to compel companies such as Google to provide lists of all mobile devices that appeared within a certain geographic area during a given time frame...

With all of that said, however, the DC Metropolitan Police and the FBI will probably need to look no further than a cursory Google search to identify many of the leaders of Wednesday's insurrection, as many of them took to social media both before and after the event to brag about it in detail. In short: you don't need fancy facial recognition tools to identify people who livestream their crimes.
Friday the Washington Post also cited "the countless hours of video — much of it taken by the rioters themselves and uploaded to social media" as a useful input for facial recognition software.

But in addition, they note that "The Capitol, more than most buildings, has a vast cellular and wireless data infrastructure of its own to make communications efficient in a building made largely of stone and that extends deep underground and has pockets of shielded areas. Such infrastructure, such as individual cell towers, can turn any connected phone into its own tracking device.

"Phone records make determining the owners of these devices trivially easy..."

A laptop was stolen from the office of U.S. House of Representatives Speaker Nancy Pelosi during the storming of the U.S. Capitol on Wednesday, one of her aides said on Friday. From a report: Drew Hammill, an aide to Democrat Pelosi, said on Twitter that the laptop belonged to a conference room and was used for presentations. He declined to offer further details. The theft of electronic devices from congressional offices has been a persistent worry following the invasion by pro-Trump followers. They were encouraged by Republican President Donald Trump at a rally beforehand to march to the Capitol while Congress was certifying Democrat Joe Biden's Nov. 3 election win. Senator Jeff Merkley, a Democrat, said on Twitter on Thursday that a laptop was taken from his office.

An anonymous reader quotes a report from Krebs On Security: The ongoing breach affecting thousands of organizations that relied on backdoored products by network software firm SolarWinds may have jeopardized the privacy of countless sealed court documents on file with the U.S. federal court system, according to a memo released Wednesday by the Administrative Office (AO) of the U.S. Courts. The judicial branch agency said it will be deploying more stringent controls for receiving and storing sensitive documents filed with the federal courts, following a discovery that its own systems were compromised as part of the SolarWinds supply chain attack. That intrusion involved malicious code being surreptitiously inserted into updates shipped by SolarWinds for some 18,000 users of its Orion network management software as far back as March 2020.

"The AO is working with the Department of Homeland Security on a security audit relating to vulnerabilities in the Judiciary's Case Management/Electronic Case Files system (CM/ECF) that greatly risk compromising highly sensitive non-public documents stored on CM/ECF, particularly sealed filings," the agency said in a statement published Jan. 6. "An apparent compromise of the confidentiality of the CM/ECF system due to these discovered vulnerabilities currently is under investigation," the statement continues. "Due to the nature of the attacks, the review of this matter and its impact is ongoing."

The AO declined to comment on specific questions about their breach disclosure. But a source close to the investigation told KrebsOnSecurity that the federal court document system was "hit hard," by the SolarWinds attackers, which multiple U.S. intelligence and law enforcement agencies have attributed as "likely Russian in origin." The source said the intruders behind the SolarWinds compromise seeded the AO's network with a second stage "Teardrop" malware that went beyond the "Sunburst" malicious software update that was opportunistically pushed out to all 18,000 customers using the compromised Orion software. This suggests the attackers were targeting the agency for deeper access to its networks and communications. The report notes that AO's court document system "may contain highly sensitive information, including intellectual property and trade secrets, or even the identities of confidential informants."

While it doesn't hold documents that are classified for national security reasons, "the system is full of sensitive sealed filings -- such as subpoenas for email records and so-called 'trap and trace' requests that law enforcement officials use to determine with whom a suspect is communicating via phone, when and for how long."

phalse phace shares a report from The Wall Street Journal: Boeing Co. will pay $2.5 billion to resolve a Justice Department investigation and admit employees misled aviation about safety issues linked to two deadly crashes of its 737 MAX jet, U.S. authorities said. Federal prosecutors had been investigating the role of two Boeing employees who interacted with the Federal Aviation Administration about the design of the 737 MAX and how much pilot training would be required for the new model.

The settlement includes a $243 million fine as well as $2.2 billion in compensation to airline customers and families of the 346 people who perished in two MAX crashes. The plane maker was charged with one count of conspiracy to defraud the U.S., but will avoid prosecution on that charge as long as it avoids legal trouble for a period of three years. The deal also calls for Boeing to comply with any ongoing investigations, including probes by foreign law-enforcement and regulatory authorities, and to beef up compliance programs, according to its agreement with prosecutors.

Japan's NEC Corp. says face marks aren't an obstacle to its facial recognition tech. Mashable reports: The Japanese company claims its new facial recognition system can identify people with face masks in less than one second, with an accuracy rate higher than 99.9 percent. The system works by closely examining the parts of a person's face not covered by a mask, such as the eyes and surrounding areas. It does require the person to submit a photo in advance, though.

The idea is for the system to be used at security checkpoints in office buildings, airports, etc., so mask-wearers can go through without removing their masks. NEC is also testing the technology out for automated payments at an unmanned convenience store in the company's headquarters in Tokyo. The company has sold the system to Lufthansa and Swiss International Airlines.

Shopify has removed stores affiliated with President Trump from its platform, citing a violation of its policies that prohibit users from promoting or supporting organizations that foment violence. CNET reports: "Shopify does not tolerate actions that incite violence," a spokesperson said in a statement. "Based on recent events, we have determined that the actions by President Donald J. Trump violate our Acceptable Use Policy, which prohibits promotion or support of organizations, platforms or people that threaten or condone violence to further a cause." Earlier today, Facebook blocked Trump's account indefinitely.

Twitter, Snapchat, and Twitch also disabled Trump's accounts.

Chinese internet companies have been violating customers' rights by misusing personal data and "bullying" people into purchases and promotions, a government-backed consumer association said on Thursday. From a report: The statement from the China Consumers Association (CCA) did not name any companies, but comes as Beijing has ramped up scrutiny of technology giants, reversing a once laissez-faire approach towards its vast internet space. "Consumers are being squeezed by data algorithms and becoming the targets of technical bullying," the association said. Companies must stop using systems to scan through consumers' personal data and offer them different prices for goods based on that information, the association said. Algorithms that checked people's internet use and other data, then sent them targeted ads and promotions, deprived customers of choice, it added. Some of the products and services promoted by these automated systems "violated the law and public order and good customs" it said, without going into further detail. Consumers' "values and moral concepts may even be distorted by algorithms and become 'playthings' in the hands of platform operators," the CCA's statement said.

An anonymous reader quotes a report from ZDNet: President-elect Joe Biden's transition team announced that David Recordon, one of OpenId and oAuth's developers, has been named the White House Director of Technology. Recordon most recently was the VP of infrastructure and security at the non-profit Chan Zuckerberg Initiative Foundation. Before that, Recordon was Facebook's engineer director. There, he had led Facebook's open-source initiatives and projects. Among other programs, this included Phabricator, a suite of code review web apps, which Facebook used for its own development. He also led efforts on Cassandra, the Apache open-source distributed database management system; HipHop, a PHP to C++ source code translator; and Apache Thrift, a software framework, for scalable cross-language services development. In short, he's both a programmer and manager who knows open-source from the inside out.

Recordon learned to program at a public elementary school. According to the Biden-Harris transition team, he's spent his almost two-decade career working at the intersection of technology, security, open-source software, public service, and philanthropy. Looking forward to the challenges Recordon faces in his new position, he wrote on LinkedIn: "The pandemic and ongoing cybersecurity attacks present new challenges for the entire Executive Office of the President, but ones I know that these teams can conquer in a safe and secure manner together." The report notes that Recordon served as the first Director of White House Information Technology during President Barack Obama's term of office, working on IT modernization and cybersecurity issues. He's also served as the Biden-Harris transition team's deputy CTO.

WhatsApp's latest terms and privacy policy allows the popular messaging app to share a significant amount of user data with Facebook. From a report: WhatsApp users are today receiving an in-app notice informing them about the app's updated terms of service and privacy policy. The notice gives an overview of the main three updates, covering how WhatsApp processes user data, how businesses can use Facebook-hosted services to store and manage their WhatsApp chats, and how WhatsApp will soon partner with Facebook to offer deeper integrations across all of the parent company's products. The changes, which are set to take effect on February 8, 2021, are mandatory and users will not be able to continue using WhatsApp unless they accept the terms.

Telegram has no plans to fix a vulnerability that makes it easy for hackers to find your precise location. The problem stems from a feature called People Nearby, which is disabled by default, but allows users who are geographically close to you to connect. Ars Technica reports: Independent researcher Ahmed Hassan, however, has shown how the feature can be abused to divulge exactly where you are. Using readily available software and a rooted Android device, he's able to spoof the location his device reports to Telegram servers. By using just three different locations and measuring the corresponding distance reported by People Nearby, he is able to pinpoint a user's precise location. Telegram lets users create local groups within a geographical area. Hassan said that scammers often spoof their location to crash such groups and then peddle fake bitcoin investments, hacking tools, stolen social security numbers, and other scams.

Telegram lets users create local groups within a geographical area. Hassan said that scammers often spoof their location to crash such groups and then peddle fake bitcoin investments, hacking tools, stolen social security numbers, and other scams. A proof-of-concept video the researcher sent to Telegram showed how he could discern the address of a People Nearby user when he used a free GPS spoofing app to make his phone report just three different locations. He then drew a circle around each of the three locations with a radius of the distance reported by Telegram. The user's precise location was where all three intersected.

In a blog post, Hassan included an email from Telegram in response to the report he had sent them. It noted that People Nearby isn't enabled by default and that "it's expected that determining the exact location is possible under certain conditions." People Nearby poses the biggest threat to people using Android devices, since they report a user's location with enough granularity to make Hassan's attack work. The recently released iOS 14, by contrast, allows users to divulge only a rough approximation of their location. People who use this feature aren't as exposed. Fixing the problem -- or at least making it much harder to exploit it -- wouldn't be hard from a technical perspective. Rounding locations to the nearest mile and adding some random bits generally suffices. When the Tinder app had a similar disclosure vulnerability, developers used this kind of technique to fix it.

Top national security agencies in a rare joint statement Tuesday confirmed that Russia was likely responsible for a massive hack of U.S. government departments and corporations, rejecting President Donald Trump's claim that China might be to blame. The Associated Press reports: The statement represented the U.S. government's first formal attempt to assign responsibility for the breaches at multiple agencies and to assign a possible motive for the operation. It said the hacks appeared to be part of an "intelligence-gathering," suggesting the evidence so far pointed to a Russian spying effort rather than an attempt to damage or disrupt U.S. government operations. "This is a serious compromise that will require a sustained and dedicated effort to remediate," said the statement, distributed by a cyber working group comprised of the FBI and other investigative agencies. Russia has denied involvement in the hack.

Last July, GitHub prevented users in Iran and several other nations from accessing portions of the service due to U.S. sanction laws. Today, the world's largest host of source code announced that it has secured a license from the U.S. government to operate in Iran. It's also working to secure similar licenses for developers in Crimea and Syria as well. MSPoweruser reports: "Over the course of two years, we were able to demonstrate how developer use of GitHub advances human progress, international communication, and the enduring U.S. foreign policy of promoting free speech and the free flow of information. We are grateful to OFAC for the engagement which has led to this great result for developers. We are in the process of rolling back all restrictions on developers in Iran, and reinstating full access to affected accounts," wrote Nat Friedman, CEO of GitHub. GitHub is also working with the U.S. government to secure similar licenses for developers in Crimea and Syria as well.