Tag: SSL

The realm of third-party trackers on Android

Luman android root cert

I was excited to learn about Lumen Privacy Monitor, as I’ve always wondered about the apps I have installed even when I have restricted the permissions wanted from the installed app.

New research co-authored by Mozilla Fellow Rishab Nithyanand explores just this: The opaque realm of third-party trackers and what they know about us. The research is titled “Apps, Trackers, Privacy, and Regulators: A Global Study of the Mobile Tracking Ecosystem,” and is authored by researchers at Stony Brook University, Data & Society, IMDEA Networks, ICSI, Princeton University, Corelight, and the University of Massachusetts Amherst.

“This is the start of a long project to uncover all the hidden data collection and data dissemination practices on the internet,” Nithyanand explains.

“There’s a huge lack of transparency around how mobile applications behave,” adds Narseo Vallina-Rodriguez, a co-author and researcher at ICSI. “People install software, but don’t know what that software is doing.”

The paper’s introduction lays out a troubling scenario: “Third-party services inherit the set of application permissions requested by the host app, allowing them access to a wealth of valuable user data, often beyond what they need to provide the expected service.”

To study this scenario, the researchers used Lumen Privacy Monitor, an Android app they built themselves over a two-year period.

So I installed it just to see what was going on with my Android devices. But there is a problem… Best summed up in this comment from Wcat.

Not open source? TLS interception? Before you install this stop and think about TLS interception. “Those who would trade privacy for security deserve neither.”

Luman asks for permissions to install its own root certificate, and this deeply worries me. TLS inception isn’t a trivial thing to be honest, I know its needed but it had me questioning how I really want to monitor the apps? Also if I remove the app, will the certificate be removed too/how would I know?

Right now, I’m keeping an eye on the app but haven’t installed the root cert yet.

Top 10 Good Tech Habits

don't feel blue


Lifehacker has a list of 10 good tech habits to have… Luckily I seems to have most of them, however its good to share them because lots of my friends have fallen fowl of some of them.

  1. Search Google Like a Pro
    Absolutely! You got to know how to use search engines fully…
  2. Back Up Your Computer
    The amount of friends who don’t do this is terrible. I don’t backup everything but the essential stuff I have backed up on Spideroak. The less important stuff I have backed up on Dropbox.
  3. Use Secure Passwords
    If I got a pound for everytime I’ve shouted Keepass!
  4. Know What Maintenance Your Computer Needs (and Doesn’t Need)
    Of course building PC’s in the past and still doing bits here and there, I certainly feel like I know my stuff, although since I moved to Ubuntu I’ve kind of lost touch with my Windows background.
  5. Be Smart About Hoaxes, Scams, and Internet Myths
    Oh I’m across this, snopes and wikipedia is your friend. Generally if you think its all makes sense
  6. Stay Safe on Public Wi-Fi
    I’m aware of the risks and never do anything serious on a non-SSL connection. I’m aware of the sniffers and have been known to throw open wireshark every once in a while.
  7. Avoid Getting Malware (and Spreading It to Others)
    Running Ubuntu over Windows means the chances of Malware is less but I’m also very aware of the risks. I usually avoid passing stuff on by just deleting them but I’ve sometimes I report them. Specially banking phishing.
  8. Keep Your Desktop and Hard Drive Free of Clutter
    Check, all good…
  9. Know When You’re Paying Too Much for a Product
    Yes although I won’t go totally out of my way for a deal, as I put a price on my time and effort
  10. Regularly Audit Your Privacy Settings on Social Networks
    My general rule applies… If its private, it shouldn’t be online. No matter what privacy settings you have check the End user licence agreement! That will tell you everything you need to know…

VPN tunnel your way to safe ground with Hamachi

Hamachi on windows

What is Hamachi?

Hamachi is a UDP-based virtual private networking system. Its peers utilize the help of a 3rd node called mediation server to locate each other and to boot strap the connection between themselves. The connection itself is direct and once it's established no traffic flows through our servers.

Hamachi is not just truly peer-to-peer, it is verifiably secure peer-to-peer.

Believe it or not, but we are able to successfully mediate p2p connections in roughly 97% of all cases we dealt with so far (few tens of thousands as of early March). This includes peers sitting behind different firewalls and/or broadband routers (aka NAT devices).

Oh my goodness, if you have not tried out Hamachi and want access to your home network from elsewhere. You need to try it out! I heard it about it ages ago but dismissed it because I didnt really see the need. Well that was before I learned about how insecure Wifi can be. So during hearing this week's Security Now podcast

I spent a hour checking out Hamachi. At the moment it runs on Windows and Linux but after verison 1.0 (there currently 0.99) it will be developed for the Mac too. I dont see why you cant run the Linux version on a Mac command line but I'm sure there is a reason. So anyhow once you got it installed you can follow the Wizard which is a little too simple but good for those not deeply into networking, its easy to escape at anytime.
Once your setup its just a matter of making a new network or joining another one. You can easily make one and the the security is then all hanged off your stupidly impossible to crack password. GRC recommends some 63 character password string which can be generated here at the High security password generator. I actually went for a stupid 96 ASCII character password with all types of characters. I'll switch it down to 63 because Hamachi uses a 256bit AES crypto for authentication. After setting the password and name of the network you can go to another machine and do the same but this time hit join and enter the same details.

Before you know it your on a new type of network. Actually a 5.x.x.x IP address. I didnt even know you could actually have one of those for a network, I always thought 10.x.x.x was the lowest things went. Ok so once you got two machines on the same p2p network your away. I was able to tunnel out of my work network and on my own computer at home and launch VNC and access the net and machines attached to the same physical network. Everything is accessable and the speed is amazing. Oh yeah by the way, I only had to open one port on Smoothwall for it to work, most firewalls and NAT environments can be traversed without opening ports and port forwarding according to the Hamachi creators. I did nothing to the work network, like Skype it just worked. Crazy but true. I also tried using Hamachi with some of the sniffing tools out there and glad to say it works perfectly. All traffic is secured and even insecure connections like POP3 retrivial can not be discovered as it all looks like normal web traffic. Honestly I cant wait for version 1.0 of Hamachi. Its solved so many of my problems its untrue.

Comments [Comments]
Trackbacks [0]