Eye-opener: Phone-y business keeps your privacy at stake

Bangalore: Omnishambles, a word that the Oxford English Dictionary added to its online edition in 2013, means "a situation that has been comprehensively mismanaged, characterized by a string of blunders and miscalculations." There is no better word to characterize the current state of the privacy and security that millions of mobile device users entrust to their service providers and device makers. The actions of some of the biggest brand names smack of gross incompetence, if not of cynical disregard. Consider these assaults -- all this month --on our right to keep our data or actions on phones, tablets or laptops confidential:

• At the Blackhat Mobile Security Summit in London on June 16, Ray Welton, a researcher with security firm NowSecure showed how a flaw in the software of the Swiftkey virtual keyboard installed in millions of Samsung Galaxy S4, S5 and S6 phones made them vulnerable to attack that could potentially snoop on camera, microphone, incoming and outgoing text messages. In a chilling demo, Welton showed how he could pose as an update to the Swiftkey software and install spyware, bypassing Android's own defences. Samsung was notified by NowSecure, of the security flaw as far back as November 2014, but chose not to go public till forced by the recent disclosures. A patch to repair the flaw has been promised Fortunately the phone is vulnerable only if you are on an unsecured network so the easy solution is to avoid such public hotspots.

• Researchers at Indiana and Peking Universities and at GeorgiaTech, have released a study which points to a vulnerability in the latest edition of Apple iOS and OSX that allows one app approved by the App store to gain access to data of another app on the same phone. They said this is because of poor levels of security in Apple's password management tool, KeyChain. Potentially one rogue app can steal iCloud, email and bank passwords. Apple was notified back in October 2014 but sought non disclosure for 6 months during which time it did little, not even warning its customers who are in a quandary. If you can't trust an app in the App store which Apple audits before approving, whom do you trust?

• First Post reported that a Bengaluru-based software engineer, who had subscribed to Airtel's 4G data service, found the speeds he was getting very slow at times. His investigation found that the service provider had inserted a piece of Java code into web pages he browsed. When he published the coding that made this happen, he was astonished to receive a legal notice from an Israel-based company that provides tools to help telecom operators make more money from their clients. Airtel denies any wrong doing and says its coding is only meant to keep track of data usage -- but that does not explain why a third party claims to be affected by the disclosure!

• In a report titled "Who has your back?", the Electronic Frontier Foundation rates social media and Internet entities on how diligently they protect your data privacy from government requests. Nine Companies receive top rating of 5 on 5. They include Adobe, Apple, DropBox, Wikimedia, Wordpress.com, and Yahoo. But WhatsApp is bottom of the class with 1/5 for its opaque policies when it comes to revealing government demands. Deccan Chronicle's Online edition carried the full score card.

These examples all in June, are disturbing enough. They come on the heels of the revelations in February that 43 models of Lenovo's laptops and tabtops came with a pre-inserted chunk of so-called adware (euphemism for spyware) that siphoned data back to a US search software player called Superfish. This inserted its own shopping hints into your browser, over and above the ones provided by --say -- Google. Since the adware was inserted by the maker it could not be cleaned by any antivirus software you may have installed. Lenovo agreed to desist only after global outrage -- but the problem is you can't remove the adware since it is part and parcel of the OS. You have to buy your own copy of Windows 8 and replace the pre-installed copy. Who pays for Lenovo's laxity? You!

Government against the people:

What happens when those charged with protecting the rights of citizens, abuse their trust? What happens when the products we buy are compromised -- with or without the collusion of the makers?

Three chilling examples of government as spy:

1. In February 2015 Russian Net security specialist Kaspersky shared results of a decade long study that showed that an organisation that it codenamed the
   Equation Group  had pulled off arguably the most sophisticated cyber attack ever, on millions of lay users. It had managed to embed its spyware in the "firmware" that sits on hard drives and solid state drives made by 12 of the world's biggest manufacturers including Maxtor, Seagate, Samsung, Toshiba and WD and sold in 30 countries including India. Being part of factory-shipped hardware, the spy software cannot be detected by anti virus tools and in effect the authors can snoop on millions of hard disks the world over. While Kaspersky did not name the suspect, there was broad indication that this was the work of the US National Security Agency. None of the makers admitted to providing any government access to their devices.
2. Also in February, The Intercept, a publication distributing the revelations of NSA whistleblower Edward Snowden, revealed what it called the Great SIM heist: a joint operation of the UK's Government Communications HQ and the US' National Security agency, where they managed to hack the encryption keys of the world's largest maker of phone SIMs -- Gemalto -- whose products used by some 400 plus wireless providers, exceed 2 billion a year. In effect the perpetrators could monitor mobile communications on any of the hacked SIMS without needing approval from telecom companies and governments. Analysts said this was tantamount to a thief getting the master key to every room in a hotel.
3. In this murky gray world of government-sponsored spying, the most chilling image can be found in Glenn Greenwald's 2014 book "No Place to Hide" (Hamish Hamilton, Rs 599), where he reproduces material provided by Edward Snowden that show that murky US agencies were intercepting shipments of networking hardware from Cisco to insert spy hardware." “We simply cannot operate this way" CISCO Chairman John Chambers protested to President Obama. The book includes a slide (
   on page 149) which purportedly shows operatives intercepting a Cisco consignment.

Introducing intentional vulnerabilities into secure products for the convenience of government -- that is the zenith of customer betrayal. But it is happening even as you read this -- and we the people are largely defenceless.