UPDATE: Verizon spies you out! – Verizon test added to NetworkToolbox

Verizon spies out their customers and creates behavioral profiles by deep packet inspection. They then even sell your data to make even more money.

You don’t believe me? Read further and finally check for yourself by using my recently added test to NetworkToolbox.

What Verizon does is that they insert some data to every network stream that goes from your device through their Wireless Cell/G3/4G/LTE network whenever you access any website. They are adding a special X-UIDH header that works like a supercookie. Any website can easily track a user, regardless of cookie blocking and other privacy protections. There is even no relationship with Verizon required.

This supercookie acts like a super UUID which uniquely identifies you to the website. Any website can track your visits and re-visits and linked websites can even track your visits to different websites.

But even worse: Verizon sells your identity to websites and closes the link between you as an anonymous visitor of a website and your real personality. It is unknown yet to what extend Verizon sells your personal information but they do and they are making lots of money with it. They call it “PrecisionID”.

Apple was blamed about the existence of the unique device ID and recently they even removed the MAC Address (as you, as a NetworkToolbox user will know). But such IDs can never be as dangerous as a unique ID inserted by your provider to any network stream between you and a website.

THIS IS CRAZY!

After hearing about that, I quickly created a scan for this type of information. To run this test, just perform a data update in your NetworkToolbox (if you don’t already did). Then, head to the “Security Check” Icon and select “Verizon Supercookie Test“.

Verizon offers the following website to switch off this supercookie:

https://www.vzw.com/myprivacy (This link needs to be copied and opened in Safari. Read below “funny side-storry” why)

I strongly suggest to use that service and once Verizon claims they switched it off, use the test to double-check if they really did.

Even if you are not a Verizon customer, just run this test and see if there is anything else your provider adds to your data stream. If so, please let contact me. Maybe we can reveal another spying provider. Would be interesting.

Funny side-story: If you visit the aforementioned link of Verizon, you will visit a website with a wrong certificate. Normally you should never bypass such a warning of your browser (even though not all browsers will generate a warning). You can use NetworkToolbox to see what’s going on here. Just use the “Certificates” tool of NetworkToolbox and enter www.vzw.com and port 443 (which is HTTPS). Now in the first line you can see where the issue is. It says “verizonwireless.com” but must say vzw.com. This is, why you get the warning.

So much to their technical expertise. Do you still trust them? I don’t.

Don’t trust the evil!
Regards,
Marcus

P.S. I am receiving a lot of mails from users per day. Some of you have new ideas but mostly questions. That’s fine and I really appreciate any mail. Please be patient if you don’t receive an immediate answer. I will either be busy on app improvements (like these days) or with answering mails.

However, based on the amount of mails, I assume there are a lot of people using my app even on a daily basis. On the other hand, there are just a few app reviews yet. If you are unhappy with my app, please let me know. My goal is to keep (or make) NetworkToolbox the best Network utility on the AppStore.

If you are happy, please write an app review (there is a button for that inside the app). App reviews are so important for app developers. Think about yourself: when will you purchase an app ? Yes, when there are many reviews saying that this app is great.

Thank you!


Do you know flurry? It spies you out!

If you hear about “flurry” and think of a sort of ice cream, you are wrong, the opposite might describe it much better.

I recently started again analyzing the traffic that is passed between the Internet and some well-known apps we may use on a daily basis. Unfortunately, such analysis is not possible with my app NetworkToolbox as Apple restricts raw-socket access so I had to use my Linux PC for this.

The situation is still quite scary. Many apps are sending detailed information about your app usage, device and personal information to third party companies. This is not new but seems to get even worse. Yelp for instance uses three services in total such as adjust.io (see www.adjust.com), sb.scorecardsearch.com (see scorecardresearch.com), settings.crashlytics.com (see crashlytics.com) and of course google analytics. Other well-known candidates are graph.facebook.com.

The worst thing I have seen was however flurry.com (see www.flurry.com). Apps using the flurry service connect to data.flurry.com and loads of information regarding my device type, name, several IDs, app usage, settings etc. will be submitted to flurry. Even worse, most apps even don’t even encrypt this information when it’s being sent.

This screwball data collection nightmare even slows down the apps and uses up my bandwidth.

This is ridiculous!

You may think, what can we do against this ?

There is a quite simple solution at least for your home network so when you are connected via WiFi from your device.

The solution is to use the child protection mechanism of your router, if available.

In my favorite AVM Fritz router, I can maintain a blacklist of websites or IP addresses that should not be available from inside my network. This is basically to prevent kids from visiting certain websites. However, this also works perfectly to protect against these evil flurry scammers. Most routers have a similar blacklist available. Sometimes it’s quite hidden and cumbersome to maintain and enable but it’s worth to spent some time in this research.

So just add data.flurry.com (or even flurry.com) to that blacklist and you are fine.

You can also add the following for some of the other scammers:

adjust.com
adjust.io
scorecardsearch.com
crashlytics.com

and you may also want to consider:

graph.facebook.com
google-analytics.com

and if you finally want to get rid of most of the adware even in apps, just add:

googleadservices.com
doubleclick.net
iadsdk.apple.com
admob.com

So once this is done, you will even experience that some of your apps will run faster, as some of those scammers didn’t even invest in fast servers. Flurry has a extreme high latency, at least in Europe and it even takes quite some time to submit all the device information and app usage to flurry.

(By the way, did you name your device something like “Mike’s iPhone”. Don’t do that otherwise they will even know your name).

As always, don’t trust the evil.

Best regards,
Marcus

P.S. if you are interested reading more articles, just head to my website networktoolbox.de/news. The app only shows the last fifteen articles due to traffic reason.


Shellshock – update #2: Yahoo and winzip.com hacked

(see updates at the end of this article)

You may have heard already about the newest security issue Shelshock which already claims to be the worst ever computer bug. I partly agree to that statement.

In short: Shellshock is a bug of a program called “bash”, which is installed on non-Windows systems such as Linux and even Mac computers. The bug allows hackers to send commands to a computer without having admin status, letting them install malicious software within systems.

We all can be affected in two ways by Shellshock:

1.) If you run a computer/server (or device) that can be accessed from outside

2.) If you access a website on a server that has already been compromised

Regarding 2.) there are already servers, known for being compromised by malware which has been installed by using the Shelshock bug. Without being too pessimistic, I think it is not unlikely that will see soon such malware that captures sensitive user information on website visitors or access databases with sensitive information. This is possible as the malware, injected by Shelshock has full system access. Let’s hope that admins of those website will update their systems quick and carefully watch their server log-files.

Regarding 1.) If you run a linux computer your own (all Mac users do) or run a webserver with linux you may be affected if the bash version on that machine has not been updated recently.
You can test for the issue by entering the following command:

env x='() { :;}; echo vulnerable' bash -c "echo no problem"

If you see two warning messages and the message “no problem” you are safe. If you see vulnerable you are in trouble if this system is accessible from the internet.
Depending on your linux distribution, you should update your system by “yum update bash” or “apt-get update” followed by “apt-get upgrade” or possibly other package managers you are using.
All current Mac computers are also affected. Yet, there is no update from Apple but updating bash (and sh) is not too complicated. A good explanation can be found here:

apple.stackexchange.com/questions/146849

Thus, securing your own systems is quite easy and you should hurry to do so.

However, what about all the devices, running linux like routers etc. ? “bash” is a quite heavyweight software which is not ideal for small devices. For instance OpenWRT/DD-WRT doesn’t use it. However, some routers and other devices such as streaming clients have bash installed and definitely need to be updated in order to get secured against Shellshock.

From my personal experience, I expect several new vulnerables and attacks for such devices in the near future. So you better should check for updates on all your devices.


UPDATE #1: Several of my webservers are already under attack, mainly from China. The biggest server is 202.38.120.248 which currently searches for insecure servers and executes a script from 195.225.34.101. I would strongly recommend to any webmaster to scan their logfiles for strings like ‘:;}’.


UPDATE #2: Yahoo and winzip.com were not as quick as us. They have been hacked already. If you have a yahoo.com account or are registered at winzip.com I urge you to change your passwords. Don’t wait. You will find more information here: www.futuresouth.us/yahoo_hacked.html.

Don’t trust the evil

Regards,

Marcus