Tornado Alley (PROG)

[fuagf]

Spy Agencies Target Mobile Phones, App Stores To Implant Spyware
CBC

Posted: 05/21/2015 7:36 am EDT Updated: 05/21/2015 8:59 am EDT



Canada and its spying partners exploited weaknesses in one of the world's most popular mobile browsers and planned to hack into smartphones via links to Google and Samsung app stores, a top secret document obtained by CBC News shows.

Electronic intelligence agencies began targeting UC Browser — a massively popular app in China and India with growing use in North America — in late 2011 after discovering it leaked revealing details about its half-billion users.

Their goal, in tapping into UC Browser and also looking for larger app store vulnerabilities, was to collect data on suspected terrorists and other intelligence targets — and, in some cases, implant spyware on targeted smartphones.

The 2012 document shows that the surveillance agencies exploited the weaknesses in certain mobile apps in pursuit of their national security interests, but it appears they didn't alert the companies or the public to these weaknesses. That potentially put millions of users in danger of their data being accessed by other governments' agencies, hackers or criminals.

"All of this is being done in the name of providing safety and yet … Canadians or people around the world are put at risk," says the University of Ottawa's Michael Geist, one of Canada's foremost experts on internet law.

CBC News analysed the top secret document in collaboration with U.S. news site The Intercept, a website that is devoted in part to reporting on the classified documents leaked by U.S. whistleblower Edward Snowden.

The so-called Five Eyes intelligence alliance — the spy group comprising Canada, the U.S., Britain, Australia and New Zealand — specifically sought ways to find and hijack data links to servers used by Google and Samsung's mobile app stores, according to the document obtained by Snowden.

Over the course of several workshops held in Canada and Australia in late 2011 and early 2012, a joint Five Eyes tradecraft team tried to find ways to implant spyware on smartphones by intercepting the transmissions sent when downloading or updating apps.

Privy to huge amounts of data

The Five Eyes alliance targeted servers where smartphones get directed whenever users download or update an app from Google and Samsung stores.

Samsung and Google declined to comment.

The servers provide key access points to massive amounts of data flowing from millions of smartphones around the world.

"What they are clearly looking for are common points, points where thousands, millions of internet users actively engage in, knowing that if they can find ways to exploit those servers, they will be privy to huge amounts of data about people's internet use, and perhaps use bits and pieces of that to make correlations," says Geist.

Ultimately, the spy agencies wanted to implant spyware on certain smartphones to take control of a person's device or extract data from it, the document suggests.

The spy agencies also sought to match their targets' smartphone devices to their online activities, using databases of emails, chats and browsing histories kept in the Five Eyes' powerful XKeyScore tool to help build profiles on the people they were tracking.

Making that connection was a much desired goal of the agencies because of the growing use of smartphones and the wealth of data they contain.

Respecting agreements not to spy on each others' citizens, the spying partners focused their attention on servers in non-Five Eyes countries, the document suggests. The agencies targeted mobile app servers in France, Switzerland, the Netherlands, Cuba, Morocco, the Bahamas and Russia.

Canada's electronic surveillance agency, the Communications Security Establishment, refused to comment on its capabilities, saying that would constitute a breach of the Security of Information Act.

"CSE is mandated to collect foreign signals intelligence to protect Canada and Canadians from a variety of threats to our national security, including terrorism," the agency said in a written statement. "CSE does not direct its foreign signals intelligence activities at Canadians or anywhere in Canada."

Britain's counterpart, GCHQ, said all its work "is carried out in accordance with a strict legal and policy framework." The U.S. National Security Agency and New Zealand surveillance agency did not respond to CBC News. Australia's signals intelligence agency refused to comment.

Millions of users have 'no idea'

As the Five Eyes team sought ways into the mobile app store servers, they also uncovered security gaps in the popular UC Browser, owned by the powerful Chinese tech giant Alibaba Group. It is the world's most popular mobile browser behind those pre-installed on smartphones.

As the team discovered, the UC Browser app leaked its users' phone numbers, SIM card numbers and details about the device to servers in China.

In that stream of data, Five Eyes analysts found one country's military unit using the app as a covert way to communicate about its operations in Western countries.

They touted this signals intelligence coup as providing an "opportunity where potentially none may have existed before," the document says.

Citizen Lab, a human rights and technology research group in Toronto, says that the UC Browser app was still leaking data until recently, and that was putting millions of users' data at risk.

"Of course, the user of this application has no idea that this is going on," says Ron Deibert, director of the Citizen Lab, which is based at the University of Toronto's Munk School of Global Affairs.

"They just assume when they open a browser that the browser's doing what it should do. But in fact, it's leaking all this information."

Citizen Lab analysed the Android version of the app and found "major security and privacy issues" in its English and Chinese editions.

National security vs. privacy

Secure apps typically encrypt a smartphone's communication with a server for such purposes as downloading or updating apps to prevent outsiders from gaining access to sensitive details about a user.

But Citizen Lab recently found Android versions of UC Browser leaking search queries, SIM card numbers and device IDs without any such protection. Some of it leaks even when the app is at rest.

Also, the app was transmitting the smartphone's location with encryption that the Citizen Lab says is easy to hack with publicly available tools.

All these details allow a government agency, hacker or criminal to track a person's movements and find out their habits, their relationships and even their interests.

Citizen Lab alerted Alibaba to the security gaps in mid-April, giving the company time to fix the problems. On May 15, after CBC News contacted the company, it released an update of the browser that fixed the issues identified by the Toronto research lab.

"We take security very seriously and we do everything possible to protect our users," said Alibaba in a written statement. "We have no evidence that any user information has been taken.

An Alibaba source familiar with the file said that spy agencies never alerted the company to vulnerabilities in the app and stressed that the app's leaks were not intentional.

Citizen Lab reviewed the update and found that the Chinese language version of the app — which leaked more data than the English one — still doesn't encrypt search terms.

The case raises questions about whether government agencies, even covert ones, should carry some responsibility for informing citizens of weaknesses they've unearthed in devices, operating systems and online infrastructure.

Taking advantage of weaknesses in apps like UC Browser "may make sense from a very narrow national security mindset, but it happened at the expense of the privacy and security of hundreds of millions of users worldwide," says Deibert.

"Of course, the security agencies don't [disclose the information]," says Deibert. "Instead, they harbour the vulnerability. They essentially weaponize it."

For his part, Geist argues that there is an expectation that the federal government will protect Canadians.

"We should be troubled by the notion of our spy agencies — and in a sense our government — actively looking for vulnerabilities or weaknesses in the software that millions of people are using," said Geist.

"That feels in many respects like a significant abdication of what I think most would expect from our government."

But not everyone agrees. "The fact that certain channels and devices are vulnerable is not ultimately the problem of signals intelligence," says Christian Leuprecht, a Royal Military College professor and fellow at Queen's University's Centre for International and Defence Policy.

If Canadians are concerned with encryption standards and privacy issues, he says, they can lobby governments to crack down on network operators, manufacturers and developers.

"Because the same way that our signals intelligence agency can follow data, devices and servers in other countries, remember that our adversaries are trying to do the exact same thing here."

CBC is working with U.S. news site The Intercept to shed light on Canada-related files in the cache of documents obtained by U.S. whistleblower Edward Snowden.

http://www.huffingtonpost.ca/2015/05/21/spy-agencies-target-mobile-phones-app-stores-to-implant-spyware_n_7349520.html

~~~

Of course the NSA planned to exploit Android apps, that’s what it does

Photo Mic Wright by Mic Wright Tweet — 22h ago in Opinion

The Intercept .. https://firstlook.org/theintercept/2015/05/21/nsa-five-eyes-google-samsung-app-stores-spyware/ .. and CBC News .. http://www.cbc.ca/news/canada/spy-agencies-target-mobile-phones-app-stores-to-implant-spyware-1.3076546 .. report that back in 2012, the US National Security Agency (NSA) along with allies from the so-called ‘Five Eyes’ alliance .. https://www.privacyinternational.org/?q=node/51 .. (which also includes Canada, the UK, New Zealand and Australia) developed a plan to hijack data links in the Google Play and Samsung app stores:

--
As part of a pilot project codenamed IRRITANT HORN, the agencies were developing a method to hack and hijack phone users’ connections to app stores so that they would be able to send malicious “implants” to targeted devices. The implants could then be used to collect data from the phones without their users noticing…

…The agencies were particularly interested in the African region, focusing on Senegal, Sudan and the Congo. But the app stores targeted were located in a range of countries, including a Google app store server located in France and other companies’ app download servers in Cuba, Morocco, Switzerland, Bahamas, the Netherlands and Russia. (At the time, the Google app store was called the “Android Market”; it is now named Google Play .. https://play.google.com/store?hl=en .)

Another major outcome of the secret workshops was the agencies’ discovery of privacy vulnerabilities in UC Browser, a popular app used to browse the Internet across Asia, particularly in China and India. Though UC Browser is not well-known in Western countries, its massive Asian user base, a reported half billion people .. http://gadgets.ndtv.com/apps/news/uc-browser-claims-to-have-crossed-500-million-global-users-milestone-498531 , means it is one of the most popular mobile Internet browsers in the world.

…The case strikes at the heart of a debate about whether spy agencies are putting ordinary people at risk by secretly exploiting security flaws in popular software instead of reporting them so that they can be fixed.
--

Make sure to read the full story, which is extensively reported and also notes the important fact that UC Browser .. https://play.google.com/store/apps/details?id=com.UCMobile.intl&hl=en .. is owned by Chinese e-commerce giant Alibaba .. http://thenextweb.com/insider/2015/03/11/alibaba-is-reportedly-investing-200m-in-snapchat-with-a-15b-valuation/ .

I have to say though, as the cache of Snowden documents continues to be drip fed to us – it’s The Intercept’s core mission – it’s becoming harder to be shocked by the revelations. The flippant conclusion is: Spies gonna spy.

The NSA and the equivalent intelligence agencies in the UK, Australia, Canada and New Zealand exist to hoover up information, particularly from unstable regions in Africa and the Middle East, and economic and political rivals like China. The latter is not shy about using underhand technological means to hack into Western computer systems .. http://thenextweb.com/asia/2015/01/19/outlook-email-service-hacked-china/ .

We may dislike it and should lobby our political representatives hard to make these agencies more accountable, but ultimately they’re doing what they were designed to do.

Can we please stop responding with faux-shock and hysteria?

http://thenextweb.com/opinion/2015/05/22/well-duh/

~~~

Senate Blocks Patriot Act Extension

May 23, 2015 1:15 AM ET
The Associated Press

The Senate struggled to prevent an interruption in critical government surveillance programs early Saturday, rejecting both a House-passed bill and a short-term extension of the USA Patriot Act.

The back-to-back votes left lawmakers without a clear fallback, although current law doesn't expire until midnight May 31.

The White House has pressured the Senate to back the House bill, which would end the National Security Agency's bulk collection of domestic phone records. Instead, the records would remain with telephone companies subject to a case-by-case review.

The vote was 57-42, short of the 60-vote threshold to move ahead.

That was immediately followed by rejection of a two-month extension to the existing programs. The vote was 45-54, again short of the 60-vote threshold.

Republican officials said Senate Majority Leader Mitch McConnell, R-Ky., intended to try again, this time with an even shorter renewal of current law.

Whatever the Senate approves must be passed by the House, which has already left Washington for a weeklong Memorial Day break.

Complicating McConnell's efforts was an attempt by fellow Kentuckian Sen. Rand Paul, who has vowed to do everything he can to prevent the renewal of the bulk phone records collection.

"My filibuster continues to end NSA illegal spying," tweeted the Republican presidential contender.

The legal provisions authorizing the programs will expire at midnight May 31, and officials say they will lose valuable surveillance tools if the Senate fails to go along with the House. But key Republican senators oppose the House approach.

At issue is a section of the Patriot Act, Section 215, used by the government to justify secretly collecting the "to and from" information about nearly every American landline telephone call. For technical and bureaucratic reasons, the program was not collecting a large chunk of mobile calling records, which made it less effective as fewer people continued to use landlines.

When former NSA contractor Edward Snowden revealed the program in 2013, many Americans were outraged that NSA had their calling records. President Barack Obama ultimately announced a plan similar to the USA Freedom Act and asked Congress to pass it. He said the plan would preserve the NSA's ability to hunt for domestic connections to international plots without having an intelligence agency hold millions of Americans' private records.

Since it gave the government extraordinary powers, Section 215 of the Patriot Act was designed to expire at midnight on May 31 unless Congress renews it.

Under the USA Freedom Act, the government would transition over six months to a system under which it queries the phone companies with known terrorists' numbers to get back a list of numbers that had been in touch with a terrorist number.

But if Section 215 expires without replacement, the government would lack the blanket authority to conduct those searches. There would be legal methods to hunt for connections in U.S. phone records to terrorists, said current and former U.S. officials who spoke on condition of anonymity because they were not authorized to discuss the matter publicly. But those methods would not be applicable in every case.

The Justice Department has said the NSA would begin winding down its collection of domestic calling records this week if the Senate fails to act because the collection takes time to halt.

http://www.npr.org/2015/05/23/408927009/senate-blocks-patriot-act-extension

See also:

N.S.A. Tapped Into North Korean Networks
Before Sony Attack, Officials Say
http://investorshub.advfn.com/boards/read_msg.aspx?message_id=110036284