DHS Says Drone Maker DJI Helping China Spy on U.S.

A memo from the U.S. Department of Homeland Security (DHS) warns that China-based Da-Jiang Innovations (DJI), one of the world’s largest drone manufacturers, has been providing information on critical infrastructure and law enforcement to the Chinese government.

The Los Angeles office of Immigrations and Customs Enforcement (ICE), specifically its Special Agent in Charge Intelligence Program (SIP), issued an intelligence bulletin back in August claiming that DJI is helping China spy on the United States.

A copy of the memo, marked “unclassified / law enforcement sensitive,” was published recently by the Public Intelligence project. The document, based on information from open source reporting and a “reliable source” in the unmanned aerial systems industry, assesses with moderate confidence that DJI is providing data on U.S. critical infrastructure and law enforcement to the Chinese government. The authors of the memo provide several examples of law enforcement and critical infrastructure organizations using DJI drones.

The agency also assesses with high confidence that the company is targeting government and private entities in these sectors in an effort to “expand its ability to collect and exploit sensitive U.S. data.” DJI using drones to help China spy on US

ICE claims two of the Android applications provided by DJI for some of its drones automatically tag GPS imagery and location, register facial recognition data even when turned off, and access data in the user’s phone. The data, which the agency claims to include personal information and other sensitive data, such as power control panels and security measures for critical infrastructure sites, is allegedly stored on cloud servers to which the Chinese government “likely has access.”

“SIP Los Angeles assesses with high confidence the critical infrastructure and law enforcement entities using DJI systems are collecting sensitive intelligence that the Chinese government could use to conduct physical or cyber attacks against the United States and its population,” the memo reads. “Alternatively, China could provide DJI information to terrorist organizations, hostile non-state entities, or state-sponsored groups to coordinate attacks against U.S. critical infrastructure.”

The intelligence bulletin also points to a recent memo of the U.S. Army, which instructs units to stop using DJI drones due to cybersecurity vulnerabilities, and a U.S. Navy memo on the operational risks associated with the use of the Chinese firm’s products. DJI has taken some measures to improve privacy following the Army ban.

The ICE document also claims that DJI aggressively dropped drone prices in 2015 to force its main competitors out of the market.

“The bulletin is based on clearly false and misleading claims from an unidentified source,” DJI said in response to the ICE memo. “Several of the key claims made by this unnamed source show a fundamental lack of understanding of DJI, its technology and the drone market.”

The company claims its products are not capable of recognizing a person’s face for identification purposes – a feature exists for tracking the movement of the shape of a person or the shape of their face in order to control the drone, but DJI claims it only works when the system is powered on and the Active Track mode is enabled.

DJI also refutes claims that its pricing strategy has caused competitors to stop production, and denies selling its products cheaper in the U.S. than in China.

“DJI does strive to comply with local laws and regulations in each country where its drones operate and to facilitate compliance by our customers. To the extent that there are location-specific rules and policies within China, we ensure that our systems comply with these rules, including the need to register or include no-fly zones on board,” DJI stated.

“In compliance with the Chinese regulation, DJI utilizes the user’s IP address, GPS location, and MCC ID to determine if a drone is being operated in China. If so, DJI provides the customer with the features necessary to comply with Chinese regulations and policies. Otherwise, DJI provides no information about or data collected by the drone to the Chinese government,” the company added.

DJI has also shared some more information regarding a recent incident involving a researcher who took part in the company’s bug bounty program. The expert had been offered $30,000 after finding some serious vulnerabilities, but he walked away from the deal due to an agreement DJI had asked him to sign.

The accusations brought against DJI are similar to the allegations that Kaspersky Lab is spying for the Russian government. Kaspersky’s products have been banned in U.S. government agencies by the DHS after several media reports on the topic. However, no evidence has been provided to back the claims.

Eduard Kovacs is an international correspondent for SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

Breach at PayPal Subsidiary Affects 1.6 Million Customers

PayPal informed customers on Friday that personal information for 1.6 million individuals may have been obtained by hackers who breached the systems of its subsidiary TIO Networks.

TIO is a publicly traded bill payment processor that PayPal acquired in July 2017 for roughly $230 million. The company is based in Canada and it serves some of the largest telecom and utility network operators in North America. TIO has more than 10,000 supported billers and it serves 16 million consumer bill pay accounts.

On November 10, PayPal announced that TIO had suspended operations in an effort to protect customers following the discovery of security vulnerabilities on the subsidiary’s platform. PayPal said it had found issues with TIO’s data security program that did not adhere to its own standards.

An investigation conducted in collaboration with third-party cybersecurity experts revealed that TIO’s network had been breached, including servers that stored the information of TIO clients and customers of TIO billers. PayPal said the attackers may have obtained personally identifiable information (PII) for roughly 1.6 million customers.

Affected companies and individuals will be contacted via mail and email, and offered free credit monitoring services via Experian.

While it’s unclear exactly what type of data the hackers have gained access to, the information shared by PayPal and TIO suggests that payment card data and in some cases even social security numbers (SSNs) may have been compromised.

PayPal has highlighted that TIO’s systems have not been integrated into its own platform. “The PayPal platform is not impacted in any way, as the TIO systems are completely separate from the PayPal network, and PayPal’s customers’ data remains secure,” the company said.

The New York State Department of Financial Services (DFS), an agency responsible for regulating financial services and products, has also issued a statement on the incident.

“DFS is working with our regulated entity, PayPal, to investigate and address issues related to cybersecurity vulnerabilities identified at PayPal’s subsidiary, TIO Networks,” the DFS said. “We applaud PayPal’s rapid response to the matter, which put consumers and business clients first, and we appreciate their efforts to inform DFS, as required, in a timely manner. Events like these illustrate the necessity of DFS’s landmark cybersecurity regulation and underscore the strength and effectiveness of our strong state-based financial services regulatory framework, including for the fintech industry.”

TIO said services will not be fully restored until it’s confident that its systems and network are secure.

Previous Columns by Eduard Kovacs:

Tags:

Police vs Privacy: US Supreme Court Looks at Cell Phone Tracking

Where do we go? Who do we talk to? What do we read about?

Our mobile phones are troves of personal, private information, and the US Supreme Court weighed Wednesday how easily police should be able to get it.

In a case seen as a landmark for privacy protection in the digital age, the court heard arguments over whether, police have the right to obtain the location data of a person’s phone from providers without a search warrant.

During the hearing, most of the high court’s nine justices appeared deeply concerned about how phone companies can track a person’s movements via their device and hand that information, sometimes going back years, to police when asked.

Civil libertarians say that information is protected by the US Constitution.

But law enforcement officials say the location data transmitted from a phone to a cell tower has been essentially made public and handed over to a third party, giving up any claim the owner might have to privacy.

The specific case involves Timothy Carpenter, who was tracked down and convicted of theft in 2011 after the police obtained some 12,898 cell tower location points for Carpenter’s device over four months from phone companies.

Justice Sonia Sotomayor appeared to agree with the pro-privacy advocates.

The cell phone “is an appendage now for some people,” she noted.

“Right now we’re only talking about the cell site records, but as I understand it, a cell phone can be pinged in your bedroom. It can be pinged at your doctor’s office. It can ping you in the most intimate details of your life — presumably at some point even in a dressing room as you’re undressing.”

– Constitutional test case –

The US Constitution’s Fourth Amendment guarantees the privacy of citizens from “unreasonable searches and seizures,” and says police must obtain warrants based on “probable cause” if they want to search a suspect’s “persons, houses, papers, and effects.”

Parties on both sides of the case agree that the law did not anticipate an era in which everyone relies on a cell phone and technology providers can amass data on a person via those phones.

Nathan Wessler, an attorney with the American Civil Liberties Union representing Carpenter, said the police collection of the phone location data constituted a “search” that required a warrant.

“The concern here is with the privacy invasion, which is quite severe over the long term, over these more than four months of data,” he told the court.

But the government argues that the location data is not like tapping a phone conversation, which is illegal without a warrant.

“We’re dealing here with routing information. We’re not dealing with the contents of communications,” argued Michael Dreeben, deputy solicitor general for the Department of Justice.

He argued that giving up the information is a voluntary act by the cell phone user, and so it is not protected.

“There is an element here of voluntariness in deciding to contract with a cell company, just like there’s an element of voluntariness in getting a landline phone and making a call,” Dreeben told the court.

– Implications for private data –

The case has much broader implications than cell phone location data, experts say.

Today, a huge amount of information from people’s lives is held by “third parties”: personal files stored in the internet cloud, information from home electronics collected by the makers of those appliances, and communications sent via cell phones and the internet.

“The advance of technology means that information you used to store in your desk drawer is now stored somewhere with third parties,” said Greg Nojeim of the Center for Democracy & Technology.

To get information in a drawer, he noted, police would have to ask the court for a warrant.

The Supreme Court will likely make a decision on the case before the end of its current term in June 2018.

Previous Columns by AFP:

Tags:

Majority of Android Apps Contain Embedded User-Tracking: Report

Seventy-five percent of 300 Android apps tested by Exodus Privacy and analyzed by the Yale Privacy Lab contain embedded trackers, including Uber, Tinder, Skype, Twitter, Spotify and Snapchat. The trackers are primarily used for targeted advertising, behavioral analytics and location tracking. They come as part of the app, and their presence and operation is likely unknown to the user at the time of installation.

Details are published in an analysis by the Yale Privacy Lab. It looked at 25 of the 44 trackers known to the French non-profit Exodus Privacy. Exodus analyzed 300 apps using its app scanning platform. According to its own research, the five most common embedded trackers are CrashLytics, DoubleClick, Localytics, Flurry and HockeyApp.

Despite this high number of trackers located by the research, Privacy Lab fears the problem could be worse. “The Exodus platform identifies trackers via signatures, like an anti-virus or spyware scanner, and thus can only detect trackers previously identified by researchers at the time of the scan.” It fears that trackers can be added to apps in software updates after installation, and that new trackers will simply not yet be identified by Exodus.

It also adds, “Tracker companies openly advertise Software Development Kits (SDKs) compatible with multiple platforms. Thus, advertising trackers may be concurrently packaged for Android and iOS, as well as more obscure mobile platforms.”

The analysis from Privacy Lab provides two examples that demonstrate its concern. Fidzup claims it has developed communication between a sonic emitter and a mobile phone. By diffusing a tone, inaudible to the human ear, inside a building Fidzup can detect the presence of mobile phones and therefore their owners. “Users installing ‘Bottin Gourmand’, a guide to restaurants and hotels in France,” warns Privacy Lab, “would thus have their physical location tracked via retail outlet speakers as they move around Paris. Their experience would be shared by readers of car magazine app ‘Auto Journal’ and TV guide app ‘TeleStar’.”

This type of technology has probably been replaced by simple WiFi tracking; but, warns the research, closely resembles the practices of Teemo and SafeGraph. Teemo was embroiled in scandal earlier this year for studying the geolocation of 10 million French citizens, and SafeGraph, who collected 17 trillion location markers for 10 million smartphones during [Thanksgiving] last year.

However, the organization is particularly concerned about the use of trackers on the finances and healthcare of users. It cites Mon AXA, developed by a multinational insurance and finance firm, and found by Exodus to contain six trackers. Privacy Lab does not know what information is shared by these trackers. Other AXA apps, including ‘HealthLook’, ‘AXA Banque’, and ‘My Doctor’ also contain trackers.

Other health and finance apps that contain trackers include those from Aetna, the American Red Cross, WebMD, American Express, Discover, HSBC, Wells Fargo, and PayPal.

Privacy Lab is calling for greater transparency from Google over privacy and security practices for trackers. “Android users, and users of all app stores, deserve a trusted chain of software development, distribution, and installation that does not include unknown or masked third-party code.”

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

GPS Android spento? Google vi ‘spia’ lo stesso

Se non è un Grande Fratello questo, poco ci manca, dato che Google è in grado di rilevare esattamente la posizione di ogni utente Android.

Sembrerebbe infatti che questa attività di rilevazione possa essere avviata non soltanto quando il GPS è spento, ma anche quando non viene stabilita una connessione wireless, quando non si è collegati alla rete dati, quando l’antenna satellitare non è in ricezione e addirittura quando la scheda SIM non è stata inserita ma la connessione WiFi è attiva.

Secondo un’indagine condotta dal quotidiano online americano Quartz, dall’inizio del 2017 i telefoni Android raccolgono gli indirizzi delle reti cellulari vicine, anche quando i servizi di localizzazione sono disattivati e inviano tali dati a Google.

Il risultato è che Google, l’unità di Alphabet dietro Android, ha accesso ai dati sulle posizioni delle persone e sui loro movimenti che vanno ben al di là di una ragionevole aspettativa di privacy da parte dei consumatori.

Quartz ha osservato la raccolta dei dati e ha contattato Google, che avrebbe confermato la pratica sostenendo che questa geolocalizzazione avrebbe il semplice scopo di migliorare ulteriormente la velocità della gestione di notifiche e messaggi push.

Gli indirizzi delle reti cellulari sono stati inclusi nelle informazioni inviate al sistema di Google negli ultimi 11 mesi. Non sono mai stati usati o conservati, ha detto il portavoce, e l’azienda sta ora prendendo provvedimenti per porre fine alla pratica entro la fine di novembre.

“Nel gennaio di quest’anno, abbiamo iniziato a utilizzare i codici di identificazione cellulare come ulteriore segnale per migliorare ulteriormente la velocità e le prestazioni di recapito dei messaggi”, ha detto in una email il portavoce di Google. “Tuttavia, non abbiamo mai incorporato Cell ID nel nostro sistema di sincronizzazione di rete, in modo tale che i dati siano stati immediatamente eliminati.

Mentre Google afferma di non utilizzare i dati sulla posizione che raccoglie utilizzando questo servizio, consente agli inserzionisti di rivolgersi ai consumatori utilizzando i dati sulla posizione, un approccio che ha un evidente valore commerciale.

Tali dati personali sono fondamentali per i successi aziendali di aziende come Facebook e Alphabet, costruiti su pubblicità personalizzate mirate e valutate per oltre 1,2 miliardi di dollari di investitori.

Faccenda non da poco dal momento che la tracciabilità della propria posizione fa parte dei dati sensibili dal Garante della Privacy. Anche se Google minimizza l’accaduto, i dati sono stati acquisiti contro la volontà di milioni di utenti per quasi 1 anno e senza dare loro informazione alcuna.

Dopo lo scandalo Uber della scorsa settimana, si prospetta non proprio un bel periodo per i colossi americani del web, sotto tiro da legislatori e autorità di regolamentazione di tutto il mondo.

Imgur Discloses 2014 Breach Affecting 1.7 Million Users

Popular image hosting website Imgur notified users on Friday that hackers had stolen data associated with 1.7 million accounts as a result of a breach that occurred back in 2014.

The company learned about the hack from Australian security expert Troy Hunt, operator of the Have I Been Pwned breach notification service, and immediately began taking steps to address the situation.

“I want to recognise Imgur’s exemplary handling of this: that’s 25 hours and 10 mins from my initial email to a press address to them mobilising people over Thanksgiving, assessing the data, beginning password resets and making a public disclosure,” Hunt said.

Others also praised the company for the way it handled the incident, with many comparing it to Uber, which attempted to cover up a massive 2016 breach that hit more than 57 million users.

Only email addresses and passwords were apparently compromised in the Imgur breach and the company says it does not ask users to provide any other data, such as real names, addresses or phone numbers.

At the time of the hack, the passwords had been stored as hashes generated using the SHA-256 algorithm, which can be cracked. The MD5Decrypt service, for example, can reveal the plaintext password from an SHA-256 hash if it’s one of the 3.7 billion strings stored in its database. Imgur said it switched to the more secure bcrypt algorithm sometime last year.

Imgur is among the world’s largest 50 websites, with more than 150 million active users every month. In 2014, when the breach occurred, the site had roughly 130 million active monthly users. Some news articles describe these figures as “unique visitors,” which suggests that not all of these users have registered an account, especially since an account is not needed to view images posted on the website.

Nevertheless, it’s possible that the actual number of compromised accounts is much higher than 1.7 million. Hunt pointed out that the data he came across only appears to include passwords that were cracked. “I don’t know how much more data may have been originally obtained,” the expert said.

Hunt also noted that 60% of the compromised accounts had already been exposed in previous breaches tracked by Have I Been Pwned.

Imgur has notified affected users and is requiring them to change their passwords. The company’s investigation into this incident is ongoing.

“We take protection of your information very seriously and will be conducting an internal security review of our system and processes,” said Roy Sehgal, Chief Operating Officer of Imgur.

Previous Columns by Eduard Kovacs:

Tags:

Data breach Uber, i Garanti Ue vogliono vederci chiaro (ma per ora hanno le mani legate)

La prossima settimana, i regolatori della privacy dell’Unione Europea discuteranno sul caso della violazione dei dati di Uber.

Secondo Isabelle Falque-Pierrotin, presidente del Gruppo di lavoro ex 29 delle autorità europee per la protezione dei dati, il caso della violazione dei dati sarà discusso nella riunione del 28 e 29 novembre, con l’obiettivo di creare una task force per coordinare le indagini e fare chiarezza sulla vicenda che ha coinvolto l’azienda americana di Carsharing.

Uber, dopo le dichiarazioni del CEO Dara Khosrowshahi di martedì scorso, si trova nell’occhio del ciclone da parte dei regolatori di mezzo mondo per aver nascosto per oltre un anno, il furto di dati di 57 milioni di clienti da parte di un gruppo di hacker.

Le informazioni rubate includevano nomi, indirizzi e-mail e numeri di cellulare degli utenti e nomi e numeri di licenza di 600.000 conducenti statunitensi. Uber ha pagato agli hacker $ 100.000 per mantenere segreta la massiccia violazione.

Molto gravi le accuse dei regolatori europei, a partire dall’autorità britannica secondo cui l’occultamento della violazione ha sollevato “enormi preoccupazioni” sulle politiche e l’etica del trattamento dati di Uber, fino al Presidente dell’Autorità italiana per la protezione dei dati personali Antonello Soro, che aveva espresso subito la necessità di misure appropriate per tutelare i cittadini italiani. “Abbiamo aperto un’istruttoria e stiamo raccogliendo tutti gli elementi utili per valutare la portata del data breach e le azioni da intraprendere a tutela degli eventuali cittadini italiani coinvolti”, aveva dichiarato mercoledì Antonello Soro, Garante Privacy. “Quello che certo colpisce, in una multinazionale digitale come Uber, è l’evidente insufficienza di adeguate misure di sicurezza a protezione dei dati e quello che sconcerta è la scarsa trasparenza nei confronti degli utenti sulla quale indagheremo” ha concluso Soro.

Uber oltre a poter essere accusata di aver ingannato gli investigatori della Federal Trade Commission (Antitrust americana) che stavano già esaminando la società per una distinta e precedente violazione, dovrà fare i conti anche con i regolatori europei. Al momento però, le autorità di protezione dei dati dell’UE non possono imporre sanzioni congiunte ma possono solamente istituire task force per coordinare le indagini nazionali e fare chiarezza.

Poco potere dunque, in attesa dell’entrata in vigore del GDPR, il regolamento generale sulla protezione dei dati il 25 maggio 2018, quando le autorità di regolamentazione avranno la facoltà di imporre multe molto più elevate – fino al 4% del fatturato globale – e di coordinarsi più strettamente.

Uber hit with 2 lawsuits over gigantic 2016 data breach

In the 48 hours since the explosive revelations that Uber sustained a massive data breach in 2016, two separate proposed class-action lawsuits have been filed in different federal courts across California.

The cases allege substantial negligence on Uber’s part: plaintiffs say the company failed to keep safe the data of the affected 50 million customers and 7 million drivers. Uber reportedly paid $100,000 to delete the stolen data and keep news of the breach quiet.

On Tuesday, CEO Dara Khosrowshahi wrote: “None of this should have happened, and I will not make excuses for it.”

The first case, Alejandro Flores v. Raiser, which was filed Tuesday in federal court in Los Angeles, described Uber’s conduct as “grossly negligent” and added that the company “departed from all reasonable standards of care.” (Raiser is Uber’s subsidiary that contracts with drivers.)

Another lawsuit was submitted Wednesday in federal court in San Francisco on behalf of two people in South Carolina.

Lawyers who filed Danyelle Townsend and Ken Tew v. Uber allege that the company should have had “administrative, physical, and technical safeguards, such as intrusion detection processes that detect data breaches in a timely manner, to protect and secure Plaintiffs’ and Nationwide Class members’ [personally identifiable information].”

“Major corporations like Uber face a higher threat of security breaches than smaller companies due in part to the large amounts of data they possess,” they wrote. “Uber knew or should have known its security systems were inadequate, particularly in light of the prior data breaches that Uber had experienced, and yet Uber failed to take reasonable precautions to safeguard the PII of Plaintiffs and members of the Nationwide Class.”

The law firm which brought Townsend, Keller Rohrback, has represented numerous clients in similar data breach lawsuits, including cases involving Sony, Equifax, and more.

“By choosing not to disclose this massive data breach and attempting to mitigate the breach by paying the hackers to destroy the data, Uber has essentially rolled the dice with its customers’ and drivers’ personal identities,” Cari Campen Laufenberg, a Keller Rohrback attorney said in a statement sent to Ars.

“What’s more, it has done so for more than a year–denying these victims the crucial opportunity to take timely steps to mitigate the disclosure of their private information.”

Uber did not immediately respond to Ars’ request for comment late Wednesday evening.