ChokePoint Project

[chokepointproject-blog]

[chokepointproject-blog]

People are walking around with tools for surveillance in their pockets. These are the tools that can be used to turn on your microphone and turn your phone into a tracking device

[chokepointproject-blog]

SAN FRANCISCO — Morgan Marquis-Boire works as a Google engineer and Bill Marczak is earning a Ph.D. in computer science. But this summer, the two men have been moonlighting as detectives, chasing an elusive surveillance tool from Bahrain across five continents.

Enlarge This Image

Hasan Jamali/Associated Press

Chanting antigovernment slogans, mourners escorted the body of a 16-year-old killed by security forces in Bahrain this month.

What they found was the widespread use of sophisticated, off-the-shelf computer espionage software by governments with questionable records on human rights. While the software is supposedly sold for use only in criminal investigations, the two came across evidence that it was being used to target political dissidents.

The software proved to be the stuff of a spy film: it can grab images of computer screens, record Skype chats, turn on cameras and microphones and log keystrokes. The two men said they discovered mobile versions of the spyware customized for all major mobile phones.

But what made the software especially sophisticated was how well it avoided detection. Its creators specifically engineered it to elude antivirus software made by Kaspersky Lab, Symantec, F-Secure and others.

The software has been identified as FinSpy, one of the more elusive spyware tools sold in the growing market of off-the-shelf computer surveillance technologies that give governments a sophisticated plug-in monitoring operation. Research now links it to servers in more than a dozen countries, including Turkmenistan, Brunei and Bahrain, although no government acknowledges using the software for surveillance purposes.

[chokepointproject-blog]

[chokepointproject-blog]

The Feds have been forced to release their social network monitoring manual, which contains the list of words the government watches on social media and news sites. Earlier the Huffington Post reported on the Feds have been forced to give up their list of words they monitor on Facebook, Twitter, and comments being posted on news articles, so I compiled that list below.

[chokepointproject-blog]

Digital Policing and Revolt in the Arab Uprisings

[chokepointproject-blog]

When Libyan rebels finally wrested control of the country last year away from its mercurial dictator, they discovered the Qaddafi regime had received an unusual gift from its allies: foreign firms had supplied technology that allowed security forces to track nearly all of the online activities of the country’s 100,000 Internet users. That technology, supplied by a subsidiary of the French IT firm Bull, used a technique called deep packet inspection (DPI) to capture e-mails, chat messages, and Web visits of Libyan citizens.

The fact that the Qaddafi regime was using deep packet inspection technology wasn’t surprising. Many governments have invested heavily in packet inspection and related technologies, which allow them to build a picture of what passes through their networks and what comes in from beyond their borders. The tools secure networks from attack—and help keep tabs on citizens.

Narus, a subsidiary of Boeing, supplies “cyber analytics” to a customer base largely made up of government agencies and network carriers. Neil Harrington, the company’s director of product management for cyber analytics, said that his company’s “enterprise” customers—agencies of the US government and large telecommunications companies—are ”more interested in what's going on inside their networks” for security reasons. But some of Narus’ other customers, like Middle Eastern governments that own their nations’ connections to the global Internet or control the companies that provide them, “are more interested in what people are doing on Facebook and Twitter.”

Surveillance perfected? Not quite, because DPI imposes its own costs. While deep packet inspection systems can be set to watch for specific patterns or triggers within network traffic, each specific condition they watch for requires more computing power—and generates far more data. So much data can be collected that the DPI systems may not be able to process it all in real time, and pulling off mass surveillance has often required nation-state budgets.

Not anymore. Thanks in part to tech developed to power giant Web search engines like Google’s—analytics and storage systems that generally get stuck with the label "big data"—"big surveillance" is now within reach even of organizations like the Olympics.

[chokepointproject-blog]

Jordanian websites have gone offline today [August 29, 2012] in protest against proposed government censorship plans and new restrictions on the Internet.

Hundreds of websites have gone black, in order to draw attention to the new legislation and its dangers. The sites have a black background, with a note which reads:

You may be deprived of the content of this sire under the amendments of the Jordanian Press and Publications Law and the governmental Internet censorship

[chokepointproject-blog]

Introduction

Earlier this year, Bahraini Human Rights activists were targeted by an email campaign that delivered a sophisticated Trojan. In From Bahrain with Love: FinFisher’s Spy Kit Exposed? we characterized the malware, and suggested that it appeared to be FinSpy, part of the FinFisher commercial surveillance toolkit. Vernon Silver concurrently reported our findings in Bloomberg, providing background on the attack and the analysis, and highlighting links to FinFisher’s parent company, Gamma International.

After these initial reports, Rapid7, a Boston-based security company, produced a follow-up analysis that identified apparent FinFisher Command and Control (C&C) servers on five continents. After the release of the Rapid7 report, Gamma International representatives spoke with Bloomberg and The New York Times’ Bits Blog, and denied that the servers found in 10 countries were instances of their products.

Following these analyses, we were contacted by both the security and activist communities with potentially interesting samples. From these, we identified several apparent mobile Trojans for the iOS, Android, BlackBerry, Windows Mobile and Symbian platforms. Based on our analysis, we found these tools to be consistent in functionality with claims made in the documentation for the FinSpy Mobile product, a component of the FinFisher toolkit. Several samples appear to be either demo versions or “unpackaged” versions ready to be customized, while others appear to be samples in active use.

[chokepointproject-blog]

Vladimir Putin says [Ru] he doesn’t use the internet very much. But he has definitely recognised its power. The biggest protest rallies in post-Soviet Russia, against Putin and his party United Russia, were organised online. No wonder that the parliamentary and presidential elections and Putin’s inauguration were all marked by the hacking of independent media websites and LiveJournal, Russia’s most popular blogging platform, via DDoS (distributed denial of service) attacks.

[chokepointproject-blog]

It isn’t a coincidence that the U.S., Canada, Australia, and the U.K. are proposing similar laws to permit monitoring of Internet communications.

[chokepointproject-blog]

It isn’t a coincidence that the U.S., Canada, Australia, and the U.K. are proposing similar laws to permit monitoring of Internet communications.

[chokepointproject-blog]

Pranesh Prakash does preliminary analysis on a leaked list of the websites blocked from August 18, 2012 till August 21, 2012 by the Indian government.

[chokepointproject-blog]

As the conflict in Syria continues unabated, we have observed an increase in the number of significant Internet outages in this war-torn country in the past six weeks. We first commented on the situation last year and again last month.

On Saturday, August 18th, the Syrian incumbent and sole domestic provider, Syria Telecommunications Establishment (STE, AS 29386), withdrew all 61 of its networks from the global routing table for roughly 17 minutes, starting at 07:59:00 UTC. Then again, on Sunday, August 19th, 20 of these networks were down several times between 04:00 UTC and 07:51:30 UTC. Sky News reporter, Tim Marshall, sent the tweet on the right from Syria at August 18th, 10:33 PST (or August 19th, 05:33 UTC).

[chokepointproject-blog]

Currently there are no mandatory data retention laws in the United States. Unlike in Europe, Internet providers are not required to track IP-address assignments so these can be linked to specific subscriber accounts.

The question is, for how long will this remain the case, especially considering SOPA author Lamar Smith’s introduction of a new bill last year. Under his Protecting Children From Internet Pornographers Act, ISPs will be required to keep IP-address logs for a minimum of a year.

For now, however, no logs are required by law.

Earlier this week the CEO of Sonic called on fellow ISPs to protect the privacy of subscribers and purge logs after two weeks like his company does. One of the reasons cited was the massive amount of civil subpoenas that are, ironically enough, often sent by “Internet pornographers” in mass-BitTorrent lawsuits.

A refreshing stance, and one that makes users of other providers curious about the logging practices of their ISPs. Unfortunately, nearly all providers are very secretive about their data retention policies. Unlike VPN providers, all admit to logging IP-addresses, but how long they retain them remains a mystery.

[chokepointproject-blog]

Tell me if you’ve been in this situation: you’re chatting about online anonymity with your wife and the other Knight-Mozilla Fellows over a pizza in Florence. A quiet-spoken stranger who had been sitting across the room walks up to your table and says “are you all here for the Tor hackathon?” You respond “why yes, yes we are!”

He goes on to explain that he is a journalist writing about Tor. He also tells us that he bets that the CIA and the Italian Secret Service are going to have moles there. What he obviously meant to say was “I work for the CIA and I’ve been watching you now for quite some time.”

It’s possible that he didn’t actually work for the CIA. His name and photo checked out under the website he claimed to write for. It was probably just a one-time job. Even if this isn’t true, even if a network of government spies didn’t track my position across Europe just to meet us in a restaurant, his comment set the tone for my weekend in Florence.

Tor is serious business.

[chokepointproject-blog]

The Internet Blackout Day initiative is aimed to create awareness among Internet users about the negative impact of the amendment on online expression.