Betrayed by your phone

 

Image from Pixabay

Last Tuesday I was in the auditorium of a hotel in Venlo. Standing on the presenter’s side in a lecture hall is a bit intimidating, but after four presentations to groups of colleagues about the risks of their online existence, it fit me like a glove.

An important part of those risks has to do with your privacy. While you can use all kinds of apps for free, most apps also do something on their own: they collect data about you. And they sell that information to advertising companies, who use this information to create profiles. Your name is not necessarily linked to this: mobile devices work with an advertising ID that is linked to your device. Is your privacy well protected by this feature? Meh.

As is often the case in information security, it is all about who you are, or sometimes also what you are. Take phishing for example. This can be done in two ways: the criminals use a dragnet and are fine with whatever they catch, or they use a spear to catch exactly the one fish they want. For example, because they know that that person has access to the company's money and is therefore a good target to receive an email 'from the CEO', stating that he must immediately transfer a nice amount of money to a certain bank account. This form of phishing is called spear phishing; you now understand why.

Back to the advertising world. As we saw, profiles are created for advertising purposes, but who says those profiles can only be used for that purpose? Suppose you have a collection of profiles. You could then create a map showing all the devices in a certain area. You don't know who they belong to, you just see the advertising IDs. Then you could single out one of those IDs and turn the question around, so to speak: where has this device been? That may provide a clue of places where the device is often found. And that in turn offers the opportunity to find out where someone works and where he lives.

For most of us, that's not a threat – we're not interesting enough for that. But what if you’re a criminal and therefore the police are looking for you? By using information, which is actually intended for placing advertisements, they may be able to get close to you. Unfortunately, it also works the other way: what if you’re in law enforcement and you have to deal with criminals that also have access to that kind of information? Of course either side also needs specialized software for this. Reputable companies that could make something like this would probably only supply such a product to law enforcement. Unfortunately, organized crime is also becoming smarter and moreover, they have plenty of money to have something like that built. That could be a serious threat. In the context of personnel care, the Dutch financial crimes unit kindly requested this blog post on the matter. But of course it can also be relevant for other colleagues and for people outside our organization.

You can do something about this quite easily. The advertising ID of your device can be turned off. This makes you invisible on the map, and your device will not appear if someone asks the question: which devices are present around this office building around eight in the morning and five in the afternoon? Advertising companies such as Google and Meta will inform you that you will then see 'less relevant' advertising. So what! I brush aside the advertising for strollers as easily as I would the advertising for running shoes. And remember, if you also have your private phone in your pocket while at work, you want to kill the advertising ID on that device as well. Here is a brief description of how to do this in iOS/IpadOS and in Android. And in this video, John Oliver explains again how trading your data works. The entire video is interesting; fast forward to 10:10 if you just want to see the part about phone location.

The above tips are of course only intended for people on the right side of the law. It is advisable for criminals not to follow the tips, because that could have all kinds of unpleasant consequences.

 

And in the big bad world...

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

• America is leading the way in regulating AI. [DUTCH]
• The Netherlands is investing in its own AI language model. [DUTCH]
• Here you can read everything you need for a business case for IAM programs.
• SolarWinds CISO has been charged with fraud.
• dozens of governments have pledged never to give in to ransomware demands.
• you can read the entire statement here.
• Payment is often the easiest solution in the event of a ransomware attack.
• Government sanctions help (somewhat) against ransomware.
• a company like Boeing is undoubtedly a big fish for ransomware criminals.
• the transition to post-quantum cryptography is not at all difficult for many organizations.
• the judge has convicted an Amersfoort resident for creating and distributing a deepfake video. [DUTCH]
• a botnet is sometimes killed by others than the police.

 

 

Big numbers

 

Image from Pixabay

I love numbers. My watch shows my heart rate and how fast I'm running, the cycling computer knows where and how fast I'm going and the weather station not only shows the indoor and outdoor temperature, but also air pressure, precipitation amount, humidity and wind speed. I keep track of my sporting and financial performance in Excel sheets. For your reassurance: I will not let all these numbers rule me (except for the finances, that is); the numbers are there for me – not the other way around.

Sometimes you are presented with figures that shock you. For example, I have had a tracker blocker running on my phone for a while now. If any app or website attempts to collect my data, this app will block it. As my phone sits here and I do nothing with it, I see the number of blocked tracking attempts in the last seven days counting up. There are currently 63,849 attempts and they come from 31 apps. Do you why I’m shocked? By the way, there are already 63,855 attempts. While I do nothing.

What worries me even more is the list of apps trying to track me. The Ziggo* GO app is one of the busiest apps that want to know something from me. It's made 1,409 attempts so far – and that's for today alone (and it's just past 9am). The point is, I hardly ever use that app, and I certainly haven't used it in the last week. When I click through, I see that all those attempts in the Ziggo app come from Adobe. You know, that company of PDF files and Photoshop. But they are also active in the field of mobile app analytics. They explain what they do as follows: “Adobe Analytics delivers comprehensive analytics for mobile, web, and apps, plus unprecedented visualization and reporting capabilities, so product teams can quickly and easily drive optimal interest on mobile devices. Whether it's improving retention or increasing conversion, we provide the predictive insights to help you get the most out of your mobile investments.”

So Ziggo uses Adobe's services to track its customers. But what does all that tracking entail? I see a list of twenty items they would like to see. For example, my email address, zip code, GPS coordinates, various information about my phone and even the orientation of the phone (portrait or landscape). Another app I barely use is Reddit , and that app has, through Branch Metrics , already 431 attempts to its name today. And my calendar app DigiCal , which I do use often, has made "only" 243 attempts, but uses the services of two companies: Google and Facebook. I don't have a Facebook account myself, but Facebook does have an account about me. They want to track as many as 31 items, including sound volume, my gender, how much memory my phone has, accelerometer data (apparently they want to see if I'm on the move) and where I am. Google also wants to know how full my battery is. I can go on like this for a while. Nu.nl** uses no fewer than four trackers, all of which largely request the same information. PostNL*** attacks me with three trackers and they are just as busy as Ziggo.

And why all this? Adobe already revealed it: a lot of money can be made through advertisements, and the more targeted the advertisement, the greater the response. Don't bombard me with ads for diapers, instead hit me with gadgets. And in order to know what I like, you need as extensive a profile of me as possible.

On my phone, all of these tracking attempts are blocked by a feature in my browser, the DuckDuckGo Private Browser. DuckDuckGo is already known as a privacy-friendly search engine, but they also have their own browser on both Android and iOS. The protection against app trackers is still in the testing phase. Incidentally, the browser itself also has a few quirks and that currently makes it less suitable for near-computer illiterate people (real computer illiterate people do not have a smartphone). Numerous other blockers are available. As with all apps, you have to be careful not to get a Trojan horse: you don't want an app that promises to protect your privacy and then creates the biggest leak itself. I always look at the number of downloads and the reviews.

Recently angry farmers blocked our highways with their tractors and politicians and police apparently found it difficult to act against this. On the digital highway, you as a user have the option to block trackers****. My weekly counter is now at 64,159 and it feels good to have blocked all these attempts.

 -------------

* Ziggo is an internet, tv and phone company.
** Nu.nl is a Dutch news outlet.
*** PostNL is a Dutch postal company.
**** In the Dutch language, there’s a pun in this: a tractor is also called ‘trekker’, which has the same pronunciation as ‘tracker’ (if the latter is pronounced the Dutch way). I’m sorry that I couldn’t make the pun work in English.

 

And in the big bad world…

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

• we should not stare blindly at TikTok , because other apps also want to track us.
• French civil servants are no longer allowed to have 'recreational apps' on their work phones at all.
• the FBI simply buys tracking data from a company.
• the leaked Vulkan files provide insight into Russia's cyberwar plans.
• this EU report forecasts which cyber threats await us in 2030.
• it’s never wise to remain silent after a data breach. [DUTCH]
• medical equipment must finally be properly secured – at least, in the US.
• a fake Tor browser steals your bitcoins.
• British police have set up fake sites to catch cybercriminals.