Uploaded by nuke

Voluntary hack and cybersecurity

Voluntary Hack and cybersecurity
By: Andang Nugroho, CISSP
Not too long ago, still fresh in our minds, a very big Indonesian unicorn online marketplace got
hacked, and some 91 million user accounts were stolen and later offered up in a dark web. Of
course, it’s no longer a surprise, companies got hacked around the world, and accounts were stolen
from them, even LinkedIn itself had its user database plucked a few years ago. Maybe because this
one was closer to home. But what really ticked me off was the formal communication they released
shortly after, stressing that users should “change their passwords periodically to prevent further data
breaches.” There was no urgency in that message at all, nothing like “we just got hacked, change
your password NOW” it was more like it’s our job as users anyway to “periodically” change our
passwords. Correct, but totally missed the mark.
It’s a good thing that hackers only attack big corporations, right? Who am I to be hacked, right? Well,
maybe it’s because we don’t need to be hacked, we already give away our data voluntarily, no?
Voluntarily hack(ed)
Do we realize how easy it is we give our (personal) data away? Maybe at a mall entrance we were
approached by an officer of a reputable for-good-cause NGO. Fill up a form, put in your full name
here, mobile phone number there, and email address too. Help us save the earth. And we did. Other
time other place, we were offered a new huge cash-back credit card, let’s go back to our stall and
photocopy your ID, and your existing credit card, only the front side they assure you. And we gave
them our cards too.
The same is true for the Internet. Nowadays, even just to download a product brochure, we need to
fill up a form therefore giving away our full name, mobile phone number, email address, and
sometimes also information on the company we work for. Just to get a brochure, which the vendor
should supposedly be glad that we took interest in. No, they want our contacts too. Yet we did fill in
those infos. And after all these, now you want other people to protect your identity?
How about when downloading and installing apps? That’s even worse.
Look at a typical screen of app
install, where they ask for
permission to access our phone.
Contacts and audio are the usual
suspects. This example was for a
local app. When I clicked “deny” the
app continued on to install, only to
crash consistently when I tried to
run it. Apparently, it absolutely
needed the access to my contacts
and microphone. But it did not even
bother to confirm during the install
that I have allowed the access,
maybe because 9 out of 10 people
would’ve said yes anyway.
It’s good to be the odd man out, but
the majority of us are giving away
freely a bunch of information. On
us, and on our friends.
LinkedIn itself from time to time asks to access my contacts to find those that are also in LinkedIn to
reconnect me there, probably to rekindle the good old time. I have so far politely denied it, but I
know that it won’t stop asking. Nor will most of the apps we have on your phone, or the apps we are
about to install on it.
Access or excess?
There are other times where we thought we have justifiedly given access, because we really need
the apps to function. Or because we “trust” the app or its maker. This is probably where the incident
of Facebook and Cambridge Analytica in 2018 sits. As a result, though arguably, it has changed the
political scene and the lives of people in the United States, forever. I will quote an article by Lauren
Goode posted in Wired here, also written in 2018, that still rings true. A powerful note from that
article is that although access granting mechanism has improved for apps, “it’s not enough to match
the sophistication of the data-gathering technology that now surrounds us.” Our data is continuously
being harvested, and almost everything is up for grab: our contacts, calendar, messages, location,
installed apps list, and most of the hardware too: speaker and mics, camera, storage, Bluetooth,
even phone orientation and screen on and off state. Talking about excess.
There have been reported incidents where a peer-to-peer lending app sent messages and harassed
the contacts it found on its late-paying client on the condition of their friend and asked them to
assist on payment. This really happens, one such incident is reported here. Typical peer-to-peer apps
are also able to detect how many other similar apps have been installed on the prospective client’s
phone to decide on whether to disburse loan or not. The extent of access given by users are
staggering, and awareness needs to be built around this to protect us, users.
Some tightening help is coming
OK, now let’s start to limit access. Of course, there is an
option to allow app access only while we are using the app.
Now location service is probably the most abused
information the apps clamor for, either needed or not, as
long as we allow them to.
But what defines “while using app?” If we swipe away the
app from screen but it is still running in the background,
can it still access my location? Turns out there is a separate
set for “enable background location” capability. If this is
turned on, the app just needs to start in the foreground,
then keeps the right to track location although it is running
invisibly from the screen. Isn’t in virtually the same as
Well, starting in IOS 13 Apple is tightening this right, removing the option “Always” and introducing
“Allow Once” which, like it reads, would allow access only once, for that session only. Next time the
app runs, it would have to re-request this right. IOS also keeps track of which apps are frequently
getting the phone location, and periodically prompts us whether this right needs to change for the
said app. Also, starting in IOS13, Bluetooth function usage needs further permission. All is good stuff.
In an almost like concerted act, Google is also getting tighter for location services with the release of
Android 10.
So we are taking better control. Information is still seeping out of our mobile phone daily, but at
least we know better what is, and can prevent ones that we really don’t want to. Still a long way to
go, though. Better control is needed for other data too, commonly asked by apps.
Back to the hack
Yes, back to the online marketplace hack we started this with. News said that user passwords were
leaked but in hashed format. Still a considerable work to break and use them. Only user information
like customer name, userid, email address, mobile phone number, etc were in clear text. Nothing
that we don’t regularly leak ourselves, right? Another day another hack, we might not be so lucky.
And that day that hack WILL eventually come, so we need to prepare.
We really should start to be more aware, more secure. Really read what information we are
surrendering when installing a new app, is it really worth it? I have now balked away from many new
and good apps because they asked for too much. I can do without them, and almost always I found
similar alternatives with better compromise in that matter.
But it really is the passwords we need to take control. Using 2FA (2-factor authentication) helps
security tremendously. Now hacker would have to steal both authentication means to really own our
accounts. Add in a salt factor like time-based authentication, then it would be exponentially more
difficult. I now use 2FA whenever possible.
Turns out that our online marketplace has had this feature for as long as I can remember. I just can’t
figure out why in the picture below, Google Authenticator still has a “NEW” label on it. There is even
a 2018 Youtube video posted by “HendriTV” here that shows how to use Google Authenticator for
the site. Maybe the label is just there as incentive to users to enable it, since it is a “new” feature.
Anyway, users DO need to enable it NOW to have better security.
Just one more thing to add. Since Google Authenticator is used as an additional factor, it is wise to
install it on a different phone. I am carrying two phones, one Android and one IOS, both have Google
Authenticator installed. To authenticate apps installed on Android, I use the Google Authenticator
on the iphone. And vice versa. All we need to do is to avoid both phones stolen at the same time.
But then there is the screenlock on both, that rely on my biometrics. I think I’m good there.
Is Google Authenticator itself safe? Not completely, read this article in Trusted Review by Hannah
Davies here, written as recent as two months ago. But, as that article said, exploitation of that
vulnerability is “yet to be detected in a real-world attack.” I just updated my Authenticator last week,
so probably that’s the cure. Hopefully.
Well, security is a rat rate. A moving target. Just don’t let us to be the rat, or the target.