📺 SensorID
Sensor Calibration Fingerprinting for Smartphones

When you visit a website, your web browser provides a range of information to the website, including the name and version of your browser, screen size, fonts installed, and so on. Ostensibly, this information allows the website to provide a great user experience. Unfortunately this same information can also be used to track you. In particular, this information can be used to generate a distinctive signature, or device fingerprint, to identify you.

📺 https://sensorid.cl.cam.ac.uk/

#tracking #android #ios #fingerprinting
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

The creep in your pocket

Mobile spyware/stalkerware services offer common users to spy on mobile devices of people close to them, such as their children or spouses. This talk presents different types of these services and touches their social impact.

The talk focuses on #android and #iOS #spyware that do not require rooting or jailbreaking the victim's device. During the talk I will also show how Android spyware #apps misuse Android OS features to spy on
victims and hide themselves on their devices. Additionally, I will discuss the legal side of these services, as well as their social impact, such as domestic violence.

📺 https://media.ccc.de/v/2019-214-the-creep-in-your-pocket

#video #mrmcd19 #CCC
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

The iPhone 11 Pro’s Location Data Puzzler

One of the more curious behaviors of Apple’s new #iPhone 11 Pro is that it intermittently seeks the user’s location information even when all #applications and #system services on the phone are individually set to never request this data. #Apple says this is by design, but that response seems at odds with the company’s own #privacy #policy.

The privacy policy available from the iPhone’s #Location #Services screen says, “If Location Services is on, your iPhone will periodically send the geo-tagged locations of nearby Wi-Fi hotspots and cell towers (where supported by a device) in an anonymous and encrypted form to Apple, to be used for augmenting this #crowd-sourced #database of Wi-Fi hotspot and cell tower locations.”

The #policy explains users can disable all location services entirely with one swipe (by navigating to Settings > Privacy > Location Services, then switching “Location Services” to “off”). When one does this, the location services indicator — a small diagonal upward arrow to the left of the battery icon — no longer appears unless Location Services is re-enabled.

The policy continues: “You can also disable location-based system services by tapping on System Services and turning off each location-based system service.” But apparently there are some system services on this model (and possibly other iPhone 11 models) which request location data and cannot be disabled by users without completely turning off location services, as the arrow icon still appears periodically even after individually disabling all system services that use location.

On Nov. 13, #KrebsOnSecurity contacted Apple to report this as a possible privacy bug in the new iPhone Pro and/or in #iOS 13.x, sharing a #video showing how the device still seeks the user’s location when each app and system service is set to “never” request location information (but with the main Location Data service still turned on).

👉🏼 Video:
https://youtu.be/37_3hd_SK24

👉🏼 Read more:
https://krebsonsecurity.com/2019/12/the-iphone-11-pros-location-data-puzzler/

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@FLOSSb0xIN

Zoom iOS App Sends Data to Facebook Even if You Don’t Have a Facebook Account

Zoom's privacy policy isn't explicit about the data transfer to Facebook at all.

As people work and socialize from home, video conferencing software Zoom has exploded in popularity. What the company and its privacy policy don't make clear is that the iOS version of the Zoom app is sending some analytics data to Facebook, even if Zoom users don't have a Facebook account, according to a Motherboard analysis of the app.

This sort of data transfer is not uncommon, especially for Facebook; plenty of apps use Facebook's software development kits (SDK) as a means to implement features into their apps more easily, which also has the effect of sending information to Facebook. But Zoom users may not be aware it is happening, nor understand that when they use one product, they may be providing data to another service altogether.

"That's shocking. There is nothing in the privacy policy that addresses that," Pat Walshe, an activist from Privacy Matters who has analyzed Zoom's privacy policy, said in a Twitter direct message.

Upon downloading and opening the app, Zoom connects to Facebook's Graph API, according to Motherboard's analysis of the app's network activity. The Graph API is the main way developers get data in or out of Facebook.

👉🏼 Read more:
https://www.vice.com/en_us/article/k7e599/zoom-ios-app-sends-data-to-facebook-even-if-you-dont-have-a-facebook-account

#zoom #iOS #privacy #Facebook #DeleteFacebook
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@FLOSSb0xIN

Riot Web 1.6, RiotX Android 0.19 & Riot iOS 0.11 — E2E Encryption by Default & Cross-signing is here!!

Hi folks,

We are incredibly excited to present the biggest change in Riot ever: as of the last 24 hours we are enabling end-to-end encryption by default for all new non-public conversations, together with a complete rework of Riot’s user experience around E2E encryption, powered by a whole new suite of encryption features in Matrix. We have released this simultaneously on Web, Desktop, iOS and RiotX Android!

👉🏼 Web:
https://riot.im/app

👉🏼 Desktop:
https://riot.im/download/desktop/

👉🏼 iOS:
https://apps.apple.com/us/app/riot-im/id1083446067

👉🏼 RiotX Android:
https://play.google.com/store/apps/details?id=im.vector.riotx

💡 More info:
https://blog.riot.im/e2e-encryption-by-default-cross-signing-is-here/

#riot #matrix #messenger #e2e #encryption #android #iOS
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@FLOSSb0xIN

Google sued for 'blatant lies' about user privacy

A new suit alleges that Android and potentially iOS users are secretly having their personal data harvested by "voyeur extraordinare" Google, even if they are not using Google's own apps.

In its second suit against Google in as many months, law firm Boies Schiller Flexner is accusing the search giant of illicitly gathering user data from mobile users. Where the previous suit was specifically regarding the use of Google Chrome, this one concerns the use of many apps on the Android platform — and potentially on iOS, too.

"Google is always watching," the suit, seen by Law360, says. "Even when it promises to look away, Google is watching. Every click, every website, every app — our entire virtual lives. Intercepted. Tracked. Logged. Compiled. Packaged. Sold for profit."

As the suit notes, Google has an optional setting to prevent tracking of "web & app activity," but it alleges that this and other reassurances about privacy are "blatant lies."

👀 👉🏼 https://appleinsider.com/articles/20/07/15/google-sued-for-blatant-lies-about-user-privacy

👀 👉🏼 https://www.law360.com/articles/1292121/boies-schiller-files-new-privacy-suit-against-voyeur-google

#DeleteGoogle #lies #android #ios #privacy #ourdata #thinkabout
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Apple escalates the Fortnite conflict and throws Epic out completely

Apple removed Fortnite from the App Store and has informed Epic that on Friday, August 28 Apple will terminate all our developer accounts and cut Epic off from iOS and Mac development tools. We are asking the court to stop this retaliation.

👀 👉🏼 https://twitter.com/EpicNewsroom/status/1295430127455596544

👀 👉🏼 🇩🇪 https://t3n.de/news/apple-eskaliert-fortnite-konflikt-1312457/

#apple #appstore #iOS #mac #epic #fortnite #court #pdf
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Malware Injected Into Xcode Projects Could Infiltrate Mac App Store

Last week, we reported on a severe new kind of Mac malware that has been found to infect via Xcode, discovered by security researchers at Trend Micro.

In an exclusive interview with #MacRumors, the security researchers behind the discovery, Oleksandr Shatkivskyi and Vlad Felenuik, have provided more information about their research.

The malware, which is part of the XCSSET family, is "an unusual infection" that is injected into Xcode projects. When the project is built, the malicious code is run. This can lead to "a rabbit hole of malicious payloads," and poses a significant risk to Mac users.

Specifically, the malware was found to be capable of abusing Safari and other browsers to steal data. It can use a vulnerability to read and dump cookies, create backdoors in JavaScript, and in turn modify displayed websites, steal private banking information and passwords, and block password changes. It was also found to be able to steal information from apps such as Evernote, Notes, Skype, Telegram, QQ, and WeChat, take screenshots, upload files to the attacker's specified server, encrypt files, and display a ransom note.

Shatkivskyi and Felenuik told MacRumors that they believe the XCSSET malware will become extremely common among bad actors who seek to exploit Mac systems. The malware is particularly dangerous because verification methods, such as checking hashes, would not identify infection. It was found to be present in projects shared on GitHub. This means that developers who rely on repositories could face a supply-chain attack and be unaware that their project has become infected.

Xcode projects infected with the malware can create maliciously modified applications, unbeknownst to the developers who make the apps, and may then distribute them as trojans. Shatkivskyi and Felenuik believe that the Mac App Store review team will be largely unable to detect apps that contain the XCSSET malware. "As an #iOS developer I know how easy it is to fool them and release an app with hidden features," Shatkivskyi said.

Shatkivskyi and Felenuik first approached Apple about the issue as early as December 2019, and they hope that Apple will be decisive and swift in its response to resolving the vulnerability. They suggest that Apple could implement privacy notifications, the likes of which came to iOS 14 and iPadOS 14, to alert Mac users when the malware is active on their systems, in an effort to explicitly alert users to a potential breach.

👀 👉🏼 https://www.macrumors.com/2020/08/24/xcode-malware-infiltrate-app-store/

#XCSSET #xcode #malware #apple #appstore
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Step-by-step guides and detailed information on secure messaging apps for Android, iOS, Windows, Mac and Linux.

💡 Apps are listed in order of:

✅✅ = "Highly Recommended"
✅ = "Worth a Try"
❌= "Not Recommended"

👀 👉🏼 https://securechatguide.org/centralizedapps.html

#secure #chat #messaging #apps #android #iOS #windows #mac #linux #guide
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

iOS uses tracking codes without the users' consent

Third-party providers can track users across different iPhone apps using unique IDs without their consent. noyd has filed two complaints against Apple.

The Austrian NGO noyb ("none of your business") has filed a complaint against Apple for accusations of illegal data collection in Germany and Spain. According to the initiative around data protection activist Max Schrems, the Group uses an identification system comparable to cookies without obtaining the necessary consent from users:inside.

The complaint concerns the so-called Identifier for Advertisers (IDFA) - a unique ID that Apple generates for each iPhone. Third parties can use this ID to track end users through various apps, for example to track purchasing behavior.

The installation or reading of tracking codes should only be possible with the consent of the users, but most of them are unaware of IDFA. The fact that, strictly speaking, these are not cookies is no argument for noyb lawyer Stefano Rossetti: "This very simple rule applies regardless of the tracking technology used. While Apple even plans to block cookies in their browser, they themselves place similar codes in their cell phones without any user consent. This is a clear violation of EU data protection laws".

👀 👉🏼 Translated with DeepL
https://netzpolitik.org/2020/ios-nutzt-tracking-codes-ohne-einwilligung-der-nutzerinnen/

👀 👉🏼 COMPLAINT (PDF)
https://noyb.eu/sites/default/files/2020-11/IDFA_Germany_DEF_Redacted.pdf

#ios #tracking #ngo #noyb #IDFA #thinkabout
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Odyssey-Jailbreak updated with iOS 13.0-13.7 support

What makes Odyssey different to other jailbreaks?

👉🏼 Fast. Really Fast.
Odyssey is the first jailbreak to be written almost entirely in Swift. It's also a snappy, responsive experience that you can't find anywhere else, with full support for all iOS 13.0-13.7 devices.

👉🏼 Completely Open.
Odyssey is completely open source, and welcomes community contributions and pull requests, as a tribute to the dearly departed s0uthwes and his continued optimism and faith in the project.

👉🏼 All new. All improved.
Odyssey comes with the open source Procursus bootstrap, designed from the ground up with openness and compatiblity in mind. Odyssey also comes equipped with full libhooker support, so speed and reliabilty are ensured.

👀 Download 👀
AltStore Repo & Shortcut

👀 IPA Download 👀

Added support for all iOS devices between iOS 13.0-13.7 (thanks to FreeTheSandbox!)
Improved exploit reliability on iOS 13.0-13.5

Download .ipa or Install via AltStore

👀 👉🏼 https://theodyssey.dev/

#theodyssey #jailbreak #apple #ios
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag

Brave-Browser: Apple thwarts the browser's payment system because it is not built on the mandatory in-app interface. Brave therefore removes functions from iOS.

Today Brave is releasing a new version (1.22) of its iOS browser in order to comply with recent stipulations made by Apple. In a nutshell, Brave users on iPhones and iPads will no longer be able to earn rewards for their attention, and will no longer be able to tip their favorite online creators via Brave. These changes to our Brave Rewards system do not apply to our desktop and Android browsers.

https://brave.com/rewards-ios/

#brave #apple #ios
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@BlackBox_Archiv
📡@NoGoolag