Home » Posts tagged "privacy" (Page 20)

利用 MAC address 抓出網路攝影機 (AirBnB 事件後續的反制)

之前 AirBnB 的屋主在屋內安裝攝影機而打官司的事情繼續被討論:「Beware, houseguests: Cheap home surveillance cameras are everywhere now」。有人提出自救方法,作者使用 DropCam 與 Withings 的 MAC Address Prefix 抓出網路攝影機:「Detect and disconnect WiFi cameras in that AirBnB you’re staying in」。

由於 MAC address 不需要知道 WPA passphase,所以可以直接掃出來。作者提供的程式需要使用 airmon-ng 來掃無線網路。

另外作者有點出這個方法可以打掛透過無線網路的裝置 (像是 WiFi jammer),用在安全機制上 (也就是這些產品本來的設計) 未必有效,還是建議用有線網路接:

For the record, I’m well aware DropCam and Withings are also sold as baby monitors and home security products. The very fact this code exists should challenge you to reconsider the non-sane choice to rely on anything wireless for home security. More so, WiFi jammers - while illegal - are cheap. If you care, use cable.

另外要注意的是,在美國地區使用這樣的技術可能是違法的,使用時請自己負責:

It may be illegal to use this script in the US. Due to changes in FCC regulation in 2015, it appears intentionally de-authing WiFi clients, even in your own home, is now classed as ‘jamming’. Up until recently, jamming was defined as the indiscriminate addition of noise to signal - still the global technical definition. It’s worth noting here that all wireless routers necessarily ship with the ability to de-auth, as part of the 802.11 specification.

Google Chrome 上有大量 Extension 在追蹤個人行為

在「Chrome Extensions – AKA Total Absence of Privacy」這邊討論了 Google Chrome 官方的 Web Store 上有很多應用程式為了賺錢在追蹤個人行為:

We’ve seen some indications on Chrome Extension-forums that it’s around $0.04 per user/month.

而且因為是 extension,可以直接穿越 Ghostery 之類的防護網,於是就變得無法 opt-out。你可以利用「In order to continuously improve and maintain this software we work with」這樣的字串去找,會以發現有不少 extension 用了 Fairshare 的方案來賺錢。

文章作者呼籲 Google 要提出方案來制止這類行為,不過我覺得 Google 應該是不會做...

利用極高頻的音波跨裝置侵犯使用者隱私

在這篇看到現在已經有跨裝置的追蹤機制:「Beware of ads that use inaudible sound to link your phone, TV, tablet, and PC」。

電視廣告利用超高頻 (人類聽不到) 與手機或平板裝置上的應用程式配對,進而組合使用者的行為:

The ultrasonic pitches are embedded into TV commercials or are played when a user encounters an ad displayed in a computer browser. While the sound can't be heard by the human ear, nearby tablets and smartphones can detect it. When they do, browser cookies can now pair a single user to multiple devices and keep track of what TV commercials the person sees, how long the person watches the ads, and whether the person acts on the ads by doing a Web search or buying a product.

難以被關閉的追蹤機制,看起來就是 NSAFBICIA 之類超愛的技術。

利用 HSTS 資訊得知網站紀錄的 sniffly

看到「sniffly」這個工具,可以利用 HSTS 資訊檢測逛過哪些網站,程式碼在「diracdeltas/sniffly」這邊可以找到:

Sniffly is an attack that abuses HTTP Strict Transport Security and Content Security Policy to allow arbitrary websites to sniff a user's browsing history. It has been tested in Firefox and Chrome.

測試網站則可以在這邊看到,作者拿 Alexa 上的資料網站來掃,所以熱門網站應該都會被放進去...

主要是利用 HSTS + CSP policy 的 timing attack (有逛過網站而瀏覽器裡有 HSTS 時的 redirect 會比較快,沒有逛過的時候會因為有網路連線而比較慢):

Sniffly sets a CSP policy that restricts images to HTTP, so image sources are blocked before they are redirected to HTTPS. This is crucial! If the browser completes a request to the HTTPS site, then it will receive the HSTS pin, and the attack will no longer work when the user visits Sniffly.

When an image gets blocked by CSP, its onerror handler is called. In this case, the onerror handler does some fancy tricks to time how long it took for the image to be redirected from HTTP to HTTPS. If this time is on the order of a millisecond, it was an HSTS redirect (no network request was made), which means the user has visited the image's domain before. If it's on the order of 100 milliseconds, then a network request probably occurred, meaning that the user hasn't visited the image's domain.

由於這個技巧,HTTPS Everywhere 必須關閉才會比較準確。

STARTTLS 的不完整性以及大規模監控電子郵件

在「Don’t count on STARTTLS to automatically encrypt your sensitive e-mails」這邊提到了 STARTTLS 的問題,引用「Neither Snow Nor Rain Nor MITM ... An Empirical Analysis of Email Delivery Security」這篇論文的說明。

SMTP 裡 STARTTLS 的設計雖然可以加密,但仲所皆知,可以阻擋 EHLO 回應結果避免建立 STARTTLS 連線,而讓發送端改用傳統未加密的 SMTP 傳輸。而研究發現其實目前就有大規模的這種監控行為:

可以看到突尼西亞的監控情況遠超過想像...

目前的想法是發展一套類似 HSTS 的 Trust on first use 設計,也許在這份報告出來後可以加速催生...

改用沒有 FairShare 版本的 JavaScript Errors Notifier

在「Chrome Devtools Tips & Tricks」這邊看到介紹 Google Chrome 的 DevTools 用法說明,但讓我注意到文章最下面提到的兩個工具,其中提到了 JavaScript Errors Notifier 這個工具:

JS Error Notifier (non-“spyware” version) creates a popup each time a Javascript error is printed to the console. Unfortunately, the main version of this extension submits private “usage data” to a third-party service (see discussion in issue #28). But at any rate, this extension has helped me notice and fix several bugs.

找資料時可以發現 Hacker News 上面也有些討論:「Malware alert: JavaScript Errors Notification extension for Chrome (86k users)」。

馬上換掉...

Archives