by Paul Arnote (parnote)
Spyware Installed By Over 11,000,000 iOS, Android, Chrome & Firefox Users
In today's abundant landscape of multiple app stores, it can be quite difficult for the security-conscious user to find apps and browser extensions that are trustworthy enough to be installed on the devices we use to access the internet. Couple that with companies that often use purposely designed sound-alike names, and it becomes even more challenging. On another front and creating yet another challenge, users can circumvent app store restrictions, and install apps and extensions from outside official app stores. Top that off with app stores that are improperly policed (if at all), and you can quickly have a nightmare situation.
Some "companies" use obfuscation to keep their true identities and affiliations in the shadows. And that is exactly the case in this instance. As reported on the AdGuard blog, one company, Big Star Labs, has recently acquired several apps and extensions that phone home to a server run by its developers with the exact address of every web page visited. Assigning a personal identifier to each user when the app or extension is installed, amassing a list of each web page every user visits (by storing it under each individual's personal identifier) can reveal a lot of information about that user, including their actual identity.
In the interest of maintaining transparency, AdGuard "sells" ad blocker software for iOS, Android, Windows and MacOS. Because AdGuard blocks ads in apps outside of the web browser, you won't find their app listed in the Google Play store, nor the Apple iOS App store. Blocking ads outside of a browser seems to be a huge no-no under both ecosystems, where that ad revenue is protected like a walled garden. To install the AdGuard ad blocker under iOS or Android, you will have to visit their web page here, and select "Purchase" at the top of the website window.
So, here is a list of the apps and browser extensions that AdGuard has found sending user information to the Big Star Labs servers, spying on its users activities:
If you have any of these apps or extensions installed, and if you value your privacy even a little bit, you might want to immediately uninstall them from your mobile devices and computers ... or, as soon as you can.
EU Competition Commissioner Sets Her Sights On Apple
Margrethe Vestager, the EU's competition commissioner, has become a thorn in the side of Silicon Valley tech companies. One month after fining Google $5 billion for anti-competitive tactics linked to its Android operating system, Vestager is now targeting the lack of standardization among phone chargers. In particular, this could spell trouble for Apple, with its proprietary Lightning connector.
Granted, there are a lot of people who shun Apple products due to the closed Apple ecosystem. There are a lot of proprietary things, including charging adapters, in the Apple system. Undisputedly, Apple makes a sizeable fortune just from the sale of those items, either directly or through affiliates who have licensed the rights from Apple.
But in 2009, Apple, along with Sony, LG, Nokia, and 10 other manufacturers, all voluntarily agreed to standardize their phone chargers. Apple, however, continues to use iterations of its Lightning connector, even expanding its abilities recently to include connecting headphones to the Lightning port, via an adapter. To date, no Apple product has ever been released with a microUSB port for charging or any other use. Further complicating the issue is the subsequent release of mobile devices that now use USB-C connectors for charging, as well as fast-charging protocols that use higher amperage to charge batteries much more rapidly than was envisioned in 2009 when the agreement was signed.
Vestager is investigating this issue again, because nine years after signing onto the voluntary agreement, Vestager feels that not enough progress has been made towards fulfilling that agreement. The tech companies all assert that there is no reason for additional regulations, and that they are "making progress" towards standardization.
Maybe I'm naive, but nine years seems like more than enough time to achieve standardization of smartphone chargers.
Firefox Add-on Could Steal Your Browsing History
Web Security was an add-on for Firefox that came with Mozilla's recommendation. However, that recommendation was based on a) over 220,000 installations, and b) a rating of 4.5 stars out of five. Had Mozilla looked a little deeper, it probably wouldn't have made the recommended add-ons list.
Shortly after being given Mozilla's recommendation, uBlock Origin developer Raymond Hill posted to a Reddit board, stating "With this extension, I see that for every page you load in your browser, there is a POST to http://126.96.36.199/. The posted data is garbled, maybe someone will have the time to investigate further." Hill posted his initial finding on August 10, 2018. On August 14, 2018, popular German blogger Kuketz posted an article about the same behavior. In just a matter of hours, a user on Kuketz's forum posted that he had managed to decode the "garbled" data. That garbled data revealed that the URL of every page visited was being sent to a German server.
Within about a day or so of the discovery, Mozilla removed Web Security and 22 other add-ons that sent user data to remote servers. Spurred on by Hill's Reddit post, Mozilla Browser engineer took a look at the source code for Web Security and other Firefox add-ons. The add-ons were removed because they either sent user data (including the URLs of sites visited) to a remote server, or because they allowed the execution of remote code.
If you have this add-on installed, you might want to remove it completely from your computers and devices that might be utilizing it.
Dropbox Will Support Only "Clean" ext4 On Linux
Are you a Linux Dropbox user? If so, this bit of news is for you. Come November 1, 2018, Dropbox will only support a "clean" ext4 file system on Linux. Thus, if you use reiserfs, btrfs or any other file system that is available under Linux, you will be out of luck. As in, you will be unable to use Dropbox.
An "official" announcement was made on the Dropbox forum, by Jay, a community moderator.
Hi everyone. On Nov. 7, 2018, we're ending support for Dropbox syncing to drives with certain uncommon file systems. The supported file systems are NTFS for Windows, HFS+ or APFS for Mac, and Ext4 for Linux.
We've updated our desktop requirements accordingly here.
A supported file system is required as Dropbox relies on extended attributes (X-attrs) to identify files in the Dropbox folder and keep them in sync. We will keep supporting only the most common file systems that support X-attrs, so we can ensure stability and a consistent experience.
If you received a notification, but are running one of the supported file systems, it's possible that you may have recently had a computer linked that was running an unsupported file system but have been since upgraded, or that computer is no longer being used.
Hope this helps to clarify matters!
A week later, Jay posted a follow-up post.
Hi all, just a brief update regarding encryption on ext4.
If you're running ext4 and eCryptfs and receive a notification about moving the Dropbox folder, then it's because eCryptfs isn't supported.
However, contrary to @JinHadah's post here, I can confirm that ext4 with full disk encryption (e.g. LUKS) is supported. We're sorry for the confusion in that chat.
If I have any further information to share in the future, I'll let you know.
Then, on August 23, 2018, I received the following email from Dropbox regarding the upcoming change to Dropbox.
This fall, we're changing the system requirements for the Dropbox desktop app for Linux.
Beginning October 15, Dropbox is ending support for Ubuntu 13.10 and below, and Fedora 20 and below. You must be using glibc 2.19 or higher to continue using the Dropbox desktop application. Please update to a supported Linux operating system (Ubuntu 14.04+ or Fedora 21+) or meet the new system requirements.
As of November 7, the Dropbox desktop app for Linux will only support the ext4 file system. Dropbox will continue to sync with supported file systems that are encrypted via full disk encryption (e.g. LUKS). Please note that ecryptfs is not supported. To ensure your files continue to sync, your Dropbox folder will need to be on a hard drive or partition that meets the new file system requirements.
Devices that do not meet the operating system or file system requirements will not be able to use the Dropbox desktop application.
Don't worry--your current files aren't going anywhere. In addition to supported Linux operating systems, you can still access files from Windows, Mac, iOS, and Android apps, or through dropbox.com.
What to do next:
You can find more information about updating your operating system on the Ubuntu and Fedora websites.
To move the location of your Dropbox folder to a supported file system or for more information, please visit our help center.
Below are some devices you might need to update:
You can see a full list of your connected Dropbox devices at the bottom of your account's security page.
- localhost.localdomain, pclinuxos, unknown version, unknown file system
We apologize for any inconvenience this may cause. For additional information, please see our help center.
The Dropbox team
It seems that, according to the Dropbox developers, there are only two "versions" of Linux: Ubuntu and Fedora. They really need to get out more.
Fortunately, PCLinuxOS has the PCLOS-Cloud available to PCLinuxOS users. If you're affected by the new Dropbox change, or are just tired of their "games," you can always make the switch to PCLOS-Cloud. You can read all about it here, in an article from the December, 2014 issue of The PCLinuxOS Magazine. Dropbox will only give you 2 GB of storage space. The PCLOS-Cloud will give you a generous 15 GB of storage space, with purchase of additional storage space for a ridiculously low extra charge.
New Chrome Feature Coming That Claims To Speed Up The Entire Internet?
I'll admit that there are a LOT of fans of the Google Chrome web browser (I am not among them, however). That is easily ascertained by Chrome occupying the top spot for the most popular/most used web browser. Market research firm Net Applications lists Chrome as having a 62% browser market share (as of July, 2018), with Microsoft's old Internet Explorer having a 12% browser market share, followed up by Mozilla Firefox's browser market share hovering around 11%.
So, how does Chrome plan to speed up the internet? Well, as it is currently, all browsers pretty much work the same. The entire web page is loaded when you visit. That means all the text, as well as all of the images. If that page makes particularly heavy use of images, that can slow down the loading time for that web page significantly.
However, some web pages are set up to use a technique called "lazy loading." With lazy loading, all the text of a page is loaded (which is typically a small download), and only the images at the top of the page are downloaded and displayed initially. Then, the downloading of the images further down on the page are downloaded in the background before you can scroll down to them.
According to the BGR website, Google Chrome developers are looking to add this lazy loading feature to every webpage that Google Chrome displays. GHacks reported on the new feature on its August 14 post, as well. The latter has the better explanation of the lazy loading feature.
While there is no timetable for lazy loading's appearance to the general public, the feature has appeared in Chrome Canary, the cutting edge development version of Google Chrome. Just as with all experimental features, lazy loading can be withdrawn at any time, without warning. Heck, Google does that even with "approved" features.
If you're running the experimental Chrome Canary, you can access the new feature by pointing your Chrome browser to chrome://flags/#enable-lazy-image-loading in the address bar.
Hacky hack hack: Australian Teen Hacks Apple Servers
An unnamed 16 year old Australian teen, enamoured by all things Apple, managed to hack into the Apple servers many times over the past year before being caught and arrested. Unnamed to us, this Australian teen, who lives near Melbourne, Australia, is reported to be well known in the hacking community.
During his forays into Apple's "secure" servers, he downloaded and accessed about 90 GB of files. He downloaded them to a folder called "hacky hack hack" on his own Mac laptop.
While Apple claims that no customer data was compromised, but The Age (previous link) has reported differently.
Apple responded to the breech with the following:
"We vigilantly protect our networks and have dedicated teams of information security professionals that work to detect and respond to threats.
"In this case, our teams discovered the unauthorised access, contained it, and reported the incident to law enforcement.
"We regard the data security of our users as one of our greatest responsibilities and want to assure our customers that at no point during this incident was their personal data compromised."
Apple noticed the breech, and immediately notified the FBI. The FBI, in turn, notified the Australian Federal Police, who conducted a raid on the teen's family residence. There, they discovered and seized two Mac laptops with serial numbers matching the devices used to access Apple's servers, along with a mobile phone and a hard drive.
The teen is said to have boasted about his exploits in WhatsApp messages. Reportedly, he broke into Apple's servers because he was a huge fan, and he dreamed of working there some day.
Amazingly, no one reporting on this incident indicated if the release of three year old Apple source code on GitHub this past February is related to this breech. I certainly wonder if this teen is the one who acquired the source code files that were posted on GitHub ... and that Apple forced its removal from GitHub shortly afterwards.