Short Topix: Dropbox Scales Back Linux Support

by Paul Arnote (parnote)

Spyware Installed By Over 11,000,000 iOS, Android, Chrome & Firefox Users

In today's abundant landscape of multiple app stores, it can be quite difficult for the security-conscious user to find apps and browser extensions that are trustworthy enough to be installed on the devices we use to access the internet. Couple that with companies that often use purposely designed sound-alike names, and it becomes even more challenging. On another front and creating yet another challenge, users can circumvent app store restrictions, and install apps and extensions from outside official app stores. Top that off with app stores that are improperly policed (if at all), and you can quickly have a nightmare situation.

Some "companies" use obfuscation to keep their true identities and affiliations in the shadows. And that is exactly the case in this instance. As reported on the AdGuard blog, one company, Big Star Labs, has recently acquired several apps and extensions that phone home to a server run by its developers with the exact address of every web page visited. Assigning a personal identifier to each user when the app or extension is installed, amassing a list of each web page every user visits (by storing it under each individual's personal identifier) can reveal a lot of information about that user, including their actual identity.

In the interest of maintaining transparency, AdGuard "sells" ad blocker software for iOS, Android, Windows and MacOS. Because AdGuard blocks ads in apps outside of the web browser, you won't find their app listed in the Google Play store, nor the Apple iOS App store. Blocking ads outside of a browser seems to be a huge no-no under both ecosystems, where that ad revenue is protected like a walled garden. To install the AdGuard ad blocker under iOS or Android, you will have to visit their web page here, and select "Purchase" at the top of the website window.

Don't try, for example, searching for Big Star Labs in the Google Play store. You likely won't find it. You're likely to find the same situation in the Apple iOS App Store. Instead, you have to read the privacy policy (and how many times do you think users do that before installing an app?). All the apps in the Google Play store have privacy policies similar to this one. That appears to be the only place the name Big Star Labs shows up in a textual form. All other references are typically in images, so their name cannot be searched for with any reliability.

So, here is a list of the apps and browser extensions that AdGuard has found sending user information to the Big Star Labs servers, spying on its users activities:

• Block Site. Privacy policy.
• Android app with 100,000+ installs.
• Chrome extension with 1,440,000+ users.
• Firefox extension with 119,000+ users.


• AdblockPrime. Privacy policy. An ad blocker for iOS. It's hard to estimate the users count as it is not distributed via App Store.


• Mobile health club apps. Privacy policy.


• Several popular Android utilities.
• Speed BOOSTER - an Android app with 5,000,000+ installs.
• Battery Saver - an Android app with 1,000,000+ installs.
• AppLock | Privacy Protector - an Android app with 500,000+ installs.
• Clean Droid - an Android app with 500,000+ installs.


• Poper Blocker. Privacy policy.
• Chrome extension with 2,280,000+ users.
• Firefox extension with 50,000+ users.


• CrxMouse. Privacy policy.
• Chrome extension with 410,000+ users.

If you have any of these apps or extensions installed, and if you value your privacy even a little bit, you might want to immediately uninstall them from your mobile devices and computers ... or, as soon as you can.

EU Competition Commissioner Sets Her Sights On Apple

Margrethe Vestager, the EU's competition commissioner, has become a thorn in the side of Silicon Valley tech companies. One month after fining Google $5 billion for anti-competitive tactics linked to its Android operating system, Vestager is now targeting the lack of standardization among phone chargers. In particular, this could spell trouble for Apple, with its proprietary Lightning connector.

Granted, there are a lot of people who shun Apple products due to the closed Apple ecosystem. There are a lot of proprietary things, including charging adapters, in the Apple system. Undisputedly, Apple makes a sizeable fortune just from the sale of those items, either directly or through affiliates who have licensed the rights from Apple.

But in 2009, Apple, along with Sony, LG, Nokia, and 10 other manufacturers, all voluntarily agreed to standardize their phone chargers. Apple, however, continues to use iterations of its Lightning connector, even expanding its abilities recently to include connecting headphones to the Lightning port, via an adapter. To date, no Apple product has ever been released with a microUSB port for charging or any other use. Further complicating the issue is the subsequent release of mobile devices that now use USB-C connectors for charging, as well as fast-charging protocols that use higher amperage to charge batteries much more rapidly than was envisioned in 2009 when the agreement was signed.

Vestager is investigating this issue again, because nine years after signing onto the voluntary agreement, Vestager feels that not enough progress has been made towards fulfilling that agreement. The tech companies all assert that there is no reason for additional regulations, and that they are "making progress" towards standardization.

Maybe I'm naive, but nine years seems like more than enough time to achieve standardization of smartphone chargers.

Firefox Add-on Could Steal Your Browsing History

Web Security was an add-on for Firefox that came with Mozilla's recommendation. However, that recommendation was based on a) over 220,000 installations, and b) a rating of 4.5 stars out of five. Had Mozilla looked a little deeper, it probably wouldn't have made the recommended add-ons list.

Shortly after being given Mozilla's recommendation, uBlock Origin developer Raymond Hill posted to a Reddit board, stating "With this extension, I see that for every page you load in your browser, there is a POST to http://136.243.163.73/. The posted data is garbled, maybe someone will have the time to investigate further." Hill posted his initial finding on August 10, 2018. On August 14, 2018, popular German blogger Kuketz posted an article about the same behavior. In just a matter of hours, a user on Kuketz's forum posted that he had managed to decode the "garbled" data. That garbled data revealed that the URL of every page visited was being sent to a German server.

Within about a day or so of the discovery, Mozilla removed Web Security and 22 other add-ons that sent user data to remote servers. Spurred on by Hill's Reddit post, Mozilla Browser engineer took a look at the source code for Web Security and other Firefox add-ons. The add-ons were removed because they either sent user data (including the URLs of sites visited) to a remote server, or because they allowed the execution of remote code.

If you have this add-on installed, you might want to remove it completely from your computers and devices that might be utilizing it.

Dropbox Will Support Only "Clean" ext4 On Linux

Are you a Linux Dropbox user? If so, this bit of news is for you. Come November 1, 2018, Dropbox will only support a "clean" ext4 file system on Linux. Thus, if you use reiserfs, btrfs or any other file system that is available under Linux, you will be out of luck. As in, you will be unable to use Dropbox.

An "official" announcement was made on the Dropbox forum, by Jay, a community moderator.

Then, on August 23, 2018, I received the following email from Dropbox regarding the upcoming change to Dropbox.

It seems that, according to the Dropbox developers, there are only two "versions" of Linux: Ubuntu and Fedora. They really need to get out more.

Fortunately, PCLinuxOS has the PCLOS-Cloud available to PCLinuxOS users. If you're affected by the new Dropbox change, or are just tired of their "games," you can always make the switch to PCLOS-Cloud. You can read all about it here, in an article from the December, 2014 issue of The PCLinuxOS Magazine. Dropbox will only give you 2 GB of storage space. The PCLOS-Cloud will give you a generous 15 GB of storage space, with purchase of additional storage space for a ridiculously low extra charge.

New Chrome Feature Coming That Claims To Speed Up The Entire Internet?

I'll admit that there are a LOT of fans of the Google Chrome web browser (I am not among them, however). That is easily ascertained by Chrome occupying the top spot for the most popular/most used web browser. Market research firm Net Applications lists Chrome as having a 62% browser market share (as of July, 2018), with Microsoft's old Internet Explorer having a 12% browser market share, followed up by Mozilla Firefox's browser market share hovering around 11%.

So, how does Chrome plan to speed up the internet? Well, as it is currently, all browsers pretty much work the same. The entire web page is loaded when you visit. That means all the text, as well as all of the images. If that page makes particularly heavy use of images, that can slow down the loading time for that web page significantly.

However, some web pages are set up to use a technique called "lazy loading." With lazy loading, all the text of a page is loaded (which is typically a small download), and only the images at the top of the page are downloaded and displayed initially. Then, the downloading of the images further down on the page are downloaded in the background before you can scroll down to them.

According to the BGR website, Google Chrome developers are looking to add this lazy loading feature to every webpage that Google Chrome displays. GHacks reported on the new feature on its August 14 post, as well. The latter has the better explanation of the lazy loading feature.

While there is no timetable for lazy loading's appearance to the general public, the feature has appeared in Chrome Canary, the cutting edge development version of Google Chrome. Just as with all experimental features, lazy loading can be withdrawn at any time, without warning. Heck, Google does that even with "approved" features.

If you're running the experimental Chrome Canary, you can access the new feature by pointing your Chrome browser to chrome://flags/#enable-lazy-image-loading in the address bar.

Hacky hack hack: Australian Teen Hacks Apple Servers

An unnamed 16 year old Australian teen, enamoured by all things Apple, managed to hack into the Apple servers many times over the past year before being caught and arrested. Unnamed to us, this Australian teen, who lives near Melbourne, Australia, is reported to be well known in the hacking community.

During his forays into Apple's "secure" servers, he downloaded and accessed about 90 GB of files. He downloaded them to a folder called "hacky hack hack" on his own Mac laptop.

While Apple claims that no customer data was compromised, but The Age (previous link) has reported differently.

Apple responded to the breech with the following:

Apple noticed the breech, and immediately notified the FBI. The FBI, in turn, notified the Australian Federal Police, who conducted a raid on the teen's family residence. There, they discovered and seized two Mac laptops with serial numbers matching the devices used to access Apple's servers, along with a mobile phone and a hard drive.

The teen is said to have boasted about his exploits in WhatsApp messages. Reportedly, he broke into Apple's servers because he was a huge fan, and he dreamed of working there some day.

Amazingly, no one reporting on this incident indicated if the release of three year old Apple source code on GitHub this past February is related to this breech. I certainly wonder if this teen is the one who acquired the source code files that were posted on GitHub ... and that Apple forced its removal from GitHub shortly afterwards.