The FCC is still not keen on the Internet freedom
a new car could as little as 22 dollars
and it's possible to fish people using Unicode.
coming up now on threat wire greetings i
am shannon morse this is threat
wire for april 25th 2017 your summary of
the threats to our security privacy and
internet freedom if you haven't checked
out our patreon yet please do so we have
lots that we want to do for the show but
we can't do it without your support my
next goal is to add a monthly Q&A
exclusively just for our patrons and we
are going to upgrade our threat wire set
super excited about that patreon com
fort the show and the link is in the
show notes now first off Internet
freedom we got some news from the
freedom part of our threat wire spectrum
to discuss today first up comes from
canada it's the canadian
radio-television and communications
commission the crtc for short they
rolled in favor of net neutrality
stating that quote internet service
providers should treat data traffic
equally to foster consumer choice
innovation and the free exchange of
ideas that means no preferential
treatment of the big data companies that
can pay the big dollars compared to the
little guys who cannot necessarily
afford it but they have excellent
content like podcasters for example of
canada's telecom providers tell us in
bell we're all for preferential
treatment while rogers was not as
consumers you will receive the same
speeds on all sites that you visit give
or take for server issues and location
obviously as I FPS will not be able to
serve up sites at different speeds
depending on how much they have pocketed
from said sites now down here in the
States we have a little bit of
alternative news we are saying the FCC
get closer and closer to abolishing net
neutrality on April twentieth the FCC
approved rolling deregulating business
data services or BDS for short which
allows for affordable access to the
internet from school small businesses
libraries community program businesses
small gas stations etc etc by
deregulating BDS
price caps on isp service is being
removed to allow for AT&T and Verizon to
charge more for these small businesses
yeah they can charge whatever they want
public interest groups such as the
Consumer Federation of America say that
this will drive up costs for consumers
isp price hike equals more overhead for
a small business which equals higher
consumer end costs for the customer
anything from a library card fee to a
credit card transaction fee could see an
increase with an average increase of
three hundred dollars out of consumer
pockets per year according to the
Consumer Federation of America now you
may think that's a small bit why worry
although I think three hundred dollars
is quite a bit of money when FCC
Chairman pie who used to be a verizon
lawyer by the way argues that price caps
aren't necessarily for markets who have
sufficient competition in which he
includes markets where only one isp is
at play I don't know how that is
sufficient competition but he thinks it
is a 2016 FCC research studies showed
that seventy-three percent of BDS
markets are single broadband provider
served a monopoly so to speak and doona
these monopolies small businesses pay
over charges of 20 billion annually
altogether due to no competition the new
elimination of price caps could increase
that by up to 20 billion as well yikes
so unless I FPS choose to use all that
new money to increase their speed build
better infrastructure and offer better
customer service I really don't see how
this is helping consumers at all
researchers at Chinese firm key who 360
and Beijing created two gadgets that
cost $22 total and make the ability to
unlock cars open their doors and
sometimes even drive away that much
easier the new gadgets dubbed hacky also
work from much farther away with the
researchers who call themselves team
unicorn I love your name by the way
claiming to be able to steal a car from
over a thousand feet away the radius
signal gadgets work as a pair with one
researcher holding one next to a key fob
and then the other one hiding the second
one next to the car the researchers next
to the car spoofs the key signal the car
relays a reply handshake to that radio
the radio then copies it and sends it to
the researcher holding the key fob and
the sec
researcher relays that handshake to the
actual key fob now the key fob replies
with the correct string of digits and
then they bounce that back to the car
and then boom the car unlocks yeah it
sounds simple it looks pretty hard
caveat an attacker wouldn't need to know
which car you are using and where you
are going they would need to be in near
proximity to your key fob so they would
have to follow you to relay the code to
their friends sitting next to your car
the code is demodulated by the two
different devices and it allows for a
long transmission over a much farther
distance the devices work against nxp
key fob ships and the manufacturers
could require a much tighter call in
response between the key fob in the car
to offset the problem and this actually
affects quite a few different cars
alternatively consumers can keep key
fobs in a Faraday bag kind of like I
keep my phone in a bag in a Faraday bag
during Def Con yeah that's the thing so
they could block any kind of
transmissions going out of the key fob
also don't steal cars that's really bad
karma I don't suggest it and in case you
are wondering no I have never stolen a
car our next story is about puny code
hopefully I'm saying that correct it is
used to represent Unicode as ASCII
characters in host names whenever you're
registering for a domain name for a new
website puny code also allows you to
register with foreign characters such as
kanji for example or basically anything
that is not Latin since the world is
very diverse and there are foreign
characters all over the place foreign
characters do exist commonly in web
domains so popular browsers leave this
as default holograph attacks can happen
whenever a ski and unicode characters
are used together in a domain so for
example if somebody used a Unicode
Cyrillic a instead of an ASCII a window
main would be the original ASCII all
ascii apple com which another would be
xn dash dash PP 0 e 40 3 d.com which
browser will then translate so that it
looks like apple com but the a is in
Cyrillic which is an alphabet used by
Slavic folks which originated from Greek
letters luckily browsers don't usually
fall for these kind of attacks but if
all of the characters are registered
using one languages non-latin Unicode
then the browser can get tricked this
flaw was found by researchers Zutons
apologies for my translation there and
was explained in a detailed blog with a
browser example for Apple in it xn dash
dash a tak 6a a 92 e dot com gets
translated to say apple com to our human
eyeballs in a different font set by the
browser and it opens up the site
obviously it's not the real apple com
which means an attacker could totally
fake out even the most paranoid of users
the only way that I could personally
tell difference between them two was
because of the elves the elves are
different in Cyrillic it's a very simple
line while in ASCII the L has a little
tail at the end of it Jing reported that
this bug was reported to Chrome back in
January and it has been fixed in chrome
58 on March 24th in Firefox you can
enable puny code translations by going
to about colon config search for puny
code and then change network ID n show
puny code from false to true so any
domains will show up with the garbled
ascii character translation instead of
the originating pretty unicode others
like safari and edge don't even support
Cyrillic language flaws so apparently
these are not affected this could be
used as a phishing attack to hide in
actual websites calm domain name so if
you are opening a link from your email
which of course I do not recommend at
all make sure you are checking that its
ASCII not something else thanks again
for all the fine people who contribute
to patreon.com/scishow going completely
independent and totally ad-free we now
have an audio-only RSS feed we have
extra content and we have early access
for our patrons we might even feature
your adorable a dorms for babies in an
upcoming episode because they are so
cute I love checking them out every
single time you guys send in pictures
and of course if you cannot donate you
can always hit the subscribe button to
share this episode on your favorite
social media page and use the hashtag
threat wire so that we might see it and
we might even retweet you with that I am
shannon morse and i will see you on the
Internet
three
Sailor Moon