Australian Gov't Says ISPs Should Spy On Users… At The Same Time It's Trying To Attack Google For Doing Less?

from the um,-hypocrisy-much? dept

We’ve been writing about the Australian government — mainly Stephen Conroy — the politician who is actively trying to censor the internet, who is absolutely livid at Google, mainly because the company has accurately pointed out what a bad idea the censorship program would be. He’s been making ridiculous and uninformed fear mongering statements about Google for a few weeks now. The latest, which is a blatant falsehood, is that Google’s WiFi snarfing collected personal banking details. But, of course, as anyone who actually knows how these things work can tell you, banking sites use encryption. Google can only read unencrypted data, and all of the evidence suggests that Google discarded any encrypted info (not that it could do anything with it anyway).

Of course, while Conroy is grandstanding about how Google might have possibly, maybe collected a tiny snippet of unsecure info that passed through an open WiFi network while it was driving by — saying that it was “the largest privacy breach in history across Western democracies,” — his government, in his area of regulation, is working on data retention plans that would require ISPs to spy on your internet usage. They don’t just want ISPs to store your IP addresses. They want your browsing history and every email stored — just in case the government wants to go back and check it some time.

That seems like a significantly bigger privacy breach than anything Google did.

Filed Under: australia, data retention, isps, spying, stephen conroy

School Laptop Spying Program Has A 'Hacker-Friendly' Security Vulneratibility

from the but,-of-course-it-does dept

It always happens. A technology used for spying on people always opens up security vulnerabilities. Sony’s “rootkit” DRM had huge security vulnerabilities that let people do bad things to your computer. And now comes the news that the LANrev system used by the Lower Merion School District to secretly photograph students at home also just happened to have a big security vulnerability that, in theory, made it possible for others to spy on children without them knowing it as well:

The LANrev program contains a vulnerability that would allow someone using the same network as one of the students to install malware on the laptop that could remotely control the computer. An intruder would be able to steal data from the computer or control the laptop webcam to snap surreptitious pictures….

The vulnerability in the LANrev system lies in the symmetric-key encryption it uses for authentication between the client and the server, and isn?t related to the optional Theft Track feature. Therefore, even computers that are not using the theft feature are potentially vulnerable.

The authentication key is stored in the client-side and server software and is fairly easy to decipher, says Frank Heidt, president and CEO of Leviathan. It took Leviathan just a few hours to determine that it?s a stanza from a German poem. The key is the same for every computer using LANrev.

The LANrev client software on a computer is configured to contact a server every minute or so to check in and see if the server has any commands for it. Knowing what the key is would let an attacker who has installed a sniffer on the network intercept that ping and masquerade as the server in communication back to the laptop. It requires the attacker to be on the same network as the target machine — for example, on a wireless network at the school or anywhere else that offers free Wi-Fi the student might use.

To be fair, there’s no evidence that anyone used this hack outside of the researchers who have discovered it, but it still raises more questions about the wisdom of using such software, especially on laptops used by kids.

Filed Under: lower merion, security, spying, students, vulnerability

Amazon Spying On Your Ebook Highlighting

from the who-owns-what-now? dept

There have already been plenty of questions over who “owns” the ebooks you’ve bought, with stories of remotely deactivated books and remotely deactivated features — neither of which happens when you have a real physical book. But there are also other concerns opened up by newly activated features. Apparently one new feature — sent in by a few concerned readers — is that Amazon will now remotely upload and store the user notes and highlights you take on your Kindle, which it then compiles into “popular highlights.”

I have no doubt that the feature provides some interesting data, but it’s not clear that users realize their highlighting and notes are being stored and used that way. Amazon basically says there’s no big privacy deal here, because the data is always aggregated. But it sounds like many users don’t realize this is happening at all. Amazon says people can find out they added this feature by reading “forum posts and help pages” — but it’s not clear how many people actually do read those things. While I’m sure many people are fine with this, others might not be. And it once again highlights a key concern in that the “features” of your “book” can change over time. Your highlighting may have been yours in the past, but suddenly it becomes Amazon’s with little notice.

Filed Under: ebooks, kindle, ownership, spying
Companies: amazon

Laptop Scandal School's Own Law Firm: Aside From Those 58,000 Spy Photos, There's No Evidence Of Spying

from the we-find-ourselves-not-guilty dept

A law firm employed by the Pennsylvania school district caught using student laptop webcams to spy on students at home has released a 72-page report (pdf) on the incident after a 10-week investigation. Most of the report’s findings aren’t too surprising; it exonerates most higher-level school officials like any wealthy school district’s in-house investigation should, concluding that there’s no evidence indicating that anybody above the IT level "knew how TheftTrack worked or understood that it could collect large quantities of webcam photographs or screenshots." The report also confirms reports that the system took some 58,000 images — a far cry from the 42 images the school originally claimed.

Aside from those 57,958 extra photos and screenshots, e-mails alleging that school administrators found the spy technology entertaining — and the fact the system was only unearthed in the first place because a student’s at-home behavior was spied on — the study concludes that “we found no evidence that District personnel used TheftTrack to “spy” on students.” Still, at least the report slams the school district for being "overzealous" in their use of the technology, and for having a complete disregard for student privacy:

"Although there is no forensic method to determine with certainty how often images stored on the LANrev server were viewed, we found no evidence that any District 3 personnel surreptitiously downloaded images from the LANrev server. Rather, the collection of images from laptops while they were in the possession of students resulted from the district’s failure to implement policies, procedures and recordkeeping requirements, and the overzealous and questionable use of technology by IS personnel without any apparent regard for privacy considerations or sufficient consultation with administrators."

By and large the study places the lion’s share of the blame on school IT folks, most of whom were already forced to retire. It does seem rather convenient that the district was allowed to hire their own law firm to investigate (at least when lawyers weren’t working with plaintiffs to allegedly help keep evidence out of the hands of federal investigators). That’s of course the first thing the lawyer for the district’s former IS director Virginia DiMedio complained about. While the IT folks certainly appear oblivious and culpable, there seems to be plenty of incompetence to go around. Hopefully higher level administrators aren’t entirely immune to the ultimate fallout, given they failed to pay any attention to the fact their district was busily building a little Macbook surveillance state with little to no accountability.

Filed Under: school, spying

Laptop Spy Scandal Administrator Just "Loved" Violating Students' Fourth Amendment Rights

from the surveillance-state-soap-opera dept

Earlier this year a school outside of Philadelphia was busted giving students laptops that included hidden software that covertly allowed school officials to turn on the cameras and monitor the students — no matter where they were. The not-so-brilliant scheme came to light when one child was disciplined for behavior that was only captured thanks to these laptops. Not surprisingly, a fairly huge scandal was born, followed by a lawsuit against the school district. The school district has long claimed that the surveillance system was only used to locate missing laptops. But a new motion (pdf) filed as part of the lawsuit now claims that not only were thousands of photos taken, many were taken of students who never reported their laptops missing. Meanwhile, the lawyer claims to have e-mails from the plan administrator (who has been pleading the fifth) highlighting how she was really having a great time watching student "soap operas" unfold:

"Back at district offices, the Robbins motion says, employees with access to the images marveled at the tracking software. It was like a window into "a little LMSD soap opera," a staffer is quoted as saying in an e-mail to Carol Cafiero, the administrator running the program. "I know, I love it," she is quoted as having replied."

One family involved in the suit provided evidence that their 15-year-old son was photographed more than 400 times over the course of two weeks last fall (his laptop was neither missing or stolen), but their lawyer provided just one surprisingly well lit and framed (for a laptop) photo taken of their son sleeping. The school district has subsequently issued a statement admitting the system took photos, but denying that they engaged in any deliberate wrong doing or that the photos were used for any "inappropriate purposes." Senator Arlen Specter, engaged in a heated battle for re-election, used the story as a springboard to call for tougher federal wiretap laws. Specter went so far as to hold a hearing near the school, where one parent insisted that warnings would be enough:

"Bob Wegbreit said a warning might suffice to let families know the district might activate webcams without a student’s knowledge. Students could then choose to keep the computers in other parts of the house, instead of their bedrooms, said Wegbreit, whose group fears the lawsuit will damage the upscale district’s finances and reputation."

It might be a little too late for that, Bob (besides, "warnings" don’t trump that whole Fourth Amendment thing). Even if you could somehow argue the project didn’t violate the Fourth Amendment, it remains mind boggling that anybody, at any level in the district, would think that off-site covert photography of students was a bright idea for any reason. As more and more schools offer kids laptops and netbooks, this case acts as a reminder to parents and students to ask questions as these kinds of programs are developed elsewhere. It’s also a warning shot to administrators who think protecting their property (or personal amusement) trumps a student’s right to privacy at home. You do start to wonder where people could possibly be getting the idea that surveillance with no recourse to law or common sense is a good idea.

Filed Under: fourth amendment, lawsuits, schools, spying

More Details Emerging About School Laptop Spying, And It Doesn't Look Good

from the a-bit-proud-of-your-spying... dept

Following up on this morning’s post, new details are emerging about the school spying scandal in which a student was punished for apparently chowing down on Mike&Ike candy (which the school thought were drugs). In our comments, someone named Paul points us to a blog post from a security consultant, who digs much deeper into the story — focusing on one of the techies who worked at the school and apparently had a noticeable internet presence, having said a few things that could come back to haunt him. Note, that the school itself has said that only two techies on staff had the power to initiate the use of the remote spying tool.

Apparently, in various forums, blog posts and videos, one of the school’s techies talked about the technology they were using and how to set it up so that the user would not realize they were being spied on. He also discussed how to prevent a laptop using this software from being “jailbroken,” so users couldn’t discover that their computers were being used in this manner. Other forum posts from students at the school show that they were told they could not use other computers, could not disable the cameras and could not jailbreak their laptops on the risk of expulsion.

Furthermore, in looking at the software that was being used, the security consultant found serious security problems with it, in some ways similar to the famed Sony BMG rootkit:

With some of my colleagues, I began a reverse engineering effort against LANRev in order to determine the nature of the threat and possible countermeasures. Some of the things we found at first left us aghast as security pros: the spyware “client” (they call it an agent) binds to the server permanently without using authentication or key distribution. Find an unbound agent on your network with Bonjour, click on it, you own it. The server software, with an externally facing Internet port… runs as root. I’m not kidding. For those unfamiliar with the principle of least privilege- this is an indicator of a highly unskilled design. Unfortunately, when we got down to basic forensics, LANRev appears to cover its tracks well.

Things keep looking worse for the school, and school officials have done little to actually explain what happened, if the prevailing story is not actually the case.

Filed Under: privacy, schools, spying, webcams

School Spying Scandal Gets Even More Bizarre: Student In Question Was Disciplined For Eating Candy

from the mike-&-ikes dept

The story of the school district that supposedly spied on some students keeps getting odder and odder. While the school district claims that it used the secret remote webcam activation technology 42 times — and only to track down stolen or lost laptops — it still hasn’t explained why this particular student was punished. He claims his laptop was not stolen and there was no reason to turn it on. The school claims that the assistant principal who supposedly confronted the student with an image from the webcam is being unfairly tarnished.

But here’s where it gets even odder. Apparently, the “improper act” that the student was disciplined for was an accusation of either drug use or drug selling. For what? Well, the image showed the student with Mike & Ikes candies, which do have a passing resemblance to pills, but (last we checked) do not appear to be controlled substances.

Now, there certainly could be more to this story, but the school has not done a particularly good job explaining its side of things.

Filed Under: candy, drugs, privacy, schools, spying, webcams

School District Says It Only Turned Spy Cameras On 42 Times; FBI Now Investigating

from the you're-on-school-district-candid-camera dept

More details are coming out about the case we wrote about yesterday concerning the school district that could (and did) turn on webcams on student laptops. The district is now claiming that, yes, it had the ability to do so, and in fact did so 42 times (though, it never told students or parents it could do this). However, the district claims that it only did so to try to track down lost or stolen laptops. That doesn’t explain how this resulted in a student being reprimanded for “improper behavior in his home” though.

Either way, it looks like this is going beyond a civil case of the families suing the school district. The FBI is now investigating the case as well, to see if the district violated either wiretapping or computer-intrusion laws. Now, it’s not unheard of to have capabilities like this turned on to find lost or stolen laptops — so perhaps that is understandable. But the fact that this kid was reprimanded for stuff he did in the privacy of his home while caught on camera definitely seems questionable. No one seems willing to say if this particular laptop was ever reported “lost or stolen,” so perhaps the district’s argument is that the student had taken the laptop. But if that’s the case, you would think they would have come out and said so, rather than the vaguely worded denials put forth already.

Filed Under: privacy, schools, spying, webcams

School Accused Of Spying On Kids In Their Homes With Spyware That Secretly Activated Webcams

from the horrifying dept

A whole bunch of you are sending in this absolutely horrifying story of a school district outside of Philadelphia that apparently gave its students laptops that included hidden software that allowed district officials to secretly turn on the laptops’ webcams and monitor student activities, no matter where they were. This all came to light when a student was disciplined for “improper behavior in his home” with the evidence being a photo of the kid from his laptop webcam. The district is now being sued for this. It’s rather stunning that anyone thought this was a good idea. Secretly spying on children in their homes when they have a very real expectation of privacy is downright horrifying. It’s not hard to see how this could be abused in very dangerous ways.

Update: Yikes. This may be more common than I thought. Julian Sanchez points us to a recent PBS Frontline episode about technology in schools that shows a school official proudly showing off the ability to spy on kids this way (well, using remote desktop emulation, rather than turning on webcams, but many of the kids seem to use webcams a lot). That part of the video starts at 4:37 and even shows him taking a photo of a girl as she does her hair via the camera:

The school administrator seems to think it’s funny to spy on kids this way. Wow.

Filed Under: privacy, schools, spying, webcams