Telegram has an amazing new idea, that saves you $5, but costs you, your privacy.
Also in your hacking news roundup: Hackers have found a new use for the humble raspberry
pi, and Facebook was caught quite literally spying on people in order to understand how
Snapchat works.
But first...
Telegram is launching something that's never been seen before, a 'Peer-to-Peer Login program'.
Essentially, Telegram wants to use your phone as a relay to send OTP text messages.
And, it works like this, when someone signs up for Telegram, they're sent a one time code
via SMS to prove their identity.
Up until now, telegram, like pretty much all other companies has sent those SMS's using
a 3rd party service, but now, they want to use your phone to send those messages instead.
In exchange you'd get a free Telegram premium subscription, saving you a measly $5 a month.
And should you agree to the deal, your phone and by extension phone number would be used
in the background to send up to 100 of these login SMSs each month.
The most obvious problem here, is that this completely breaks your privacy because the
message's recipient can easily see your phone number, and there's nothing stopping them
from texting you back and, well - who knows what trolls could get up to.
Telegram totally acknowledges this problem and says in their Terms of Service: "Therefore,
you acknowledge and agree that you have considered any and all potential repercussions this may
entail".
But arguably, things are worse for OTP recipients because they'll likely end up associating
the sender's number with Telegram itself, which could be abused by bad guys who sign
up to this program so that they can send recipients follow up messages that then lead them into
scams.
But, surely if something goes wrong, Telegram will step in and make things right, right?
Well, no, their terms say "You acknowledge and agree that Telegram shall bear no liability
for any costs, expenses, damages, or any other adverse or other..."
- I think you get the idea, you're on your own.
This is a very strange program for an App that prides itself on being privacy conscious
to introduce.
I mean - in their FAQ, Telegram says that one of the most "important components of Internet
privacy" is "Protecting your personal data from third parties" - but, this does the exact
opposite.
Telegram says they're introducing this program to make OTP codes more "reliable", though
I can't understand how this improves reliability.
And at a guess, I'd say this is all about money.
Because, every time a company sends an OTP code it comes with a cost.
For example, if you were to use Google Cloud's identity platform to send an MFA SMS it would
cost 1 cent for US numbers, or 5 cents for UK numbers, which really doesn't sound that
bad.
However, for some countries it's a totally different story, to send a text to an Indonesian
number for example we're talking 34 cents per SMS so it's easy to see how costs add
up quickly.
This is one reason why last year X, back when it was called Twitter, restricted SMS based
2FA to premium users only - another reason they did that, according to Elon Musk is that
they were losing $60 million dollars a year to fraudulent SMS messages.
SMS Pump fraud as it's called, happens when cyber criminals use bots to spam SMS 2FA systems
with premium rate numbers - now, I hadn't heard of this issue until now, but apparently
it's a big problem for tech companies, which in 2021 caused global losses of $6.7 billion
dollars.
And now, it could be your problem too if you sign up to Telegram's new program, because
as per the Terms of Service, "You understand and agree that SMS messages sent from your
number as part of the P2PL Program may incur charges from your mobile carrier or service
provider.", which is all, your, problem.
Oh and one more reason this new program is an awful idea is that your phone contract
likely comes with a clause that you must only use it for personal use... so by renting your
phone dumber out to Telegram you're likely violating that, which could see your number
getting disconnected.
Telegram has always had a strange relationship with privacy and security, they're open source,
but only partially.
They're seen as privacy focused... but end-to-end encryption isn't enabled on all chats, and
where it is they use some proprietary encryption method, that some researchers aren't convinced
is totally secure.
This program is yet another thing to add to the list.
But if saving $5 is worth it to you, the new program is Android only, and only available
in certain regions, presumably where those SMS costs are sky high.
Cyber criminals have found a new use for the humble raspberry pi - turning them into anonymisation
devices to help keep their nefarious activities hidden.
The software that makes this possible is called 'GEOBOX', the idea is that once setup on a
raspberry pi, it’ll spawn a WiFi network that you can connect to and use as a kind
of conduit to do illegal things.
However, 'GEOBOX' doesn't do anything special per se - it relies on you to configure it
with proxies, VPNs, and among other things it also gives you the option to spoof a GPS
location.
What makes GEOBOX different is just how noob friendly it is - implementing all these individual
features yourself on a fresh raspberry pi would require downloading a bunch of different
tools and more importantly, knowing how to configure them properly - which is full of
pit falls.
There's many cases of hackers being caught due to basic misconfigurations, like the Ubiquiti
hacker, who was caught after his VPN momentarily dropped revealing his true ip - and that guy
was a senior software engineer.
Bit of a crazy story that one, I'll link to my video on it up here.
The aim with 'GEOBOX' is to create a kind of all-in-one solution, coming with all the
features a cyber criminal might need, without the requirement to really know what they're
doing.
And the pi is the perfect platform for this, they're cheap, easily concealable, and now
that the shortage of the last couple years has come to an end they're incredibly easy
to get your hands on.
They're also very disposable, 'GEOBOX' comes with a hard reset feature that just involves
shorting 2 pins, alternatively, you could break the SD Card, or in four lions style,
eat it and save it for later.
You might be thinking that TOR would be a better option for cyber criminals, rather
than some dodgy software being sold on Russian Telegram channels for $80 per month, or $700
for a lifetime license.
But whilst TOR is great for anonymity, it's also incredibly obvious to websites that you're
using it because of course the IPs of all TOR nodes is public knowledge.
And if you've tried using TOR to browse the clearnet, you'll know exactly what I mean.
For a bad guy to, for example, fraudulently log into and drain your bank account they
need to be able to at least appear legitimate in order to bypass anti-fraud filters, by
spoofing locations and so on, which GEOBOX makes possible with noob level knowledge.
However, whilst it might sound a bit cynical to just assume this device is made for criminals,
after all caring about your privacy is not a crime... the device is primarily sold on
Russian Telegram channels - which are notorious for bad behaviour, shall we say.
And the analysts at 'Resecurity' who we can thank for the writeup on this, explain that
they only discovered the software, "during an investigation into an online banking theft
involving a high-net-worth (HNW) client of a leading Fortune 100 financial institution.",
in that case "The malicious individuals utilized several GEOBOX devices, each connected to
the Internet and strategically placed in various remote locations.
These devices served as proxies, significantly enhancing their anonymity.".
Whilst GEOBOX is no doubt very powerful and useful for cyber criminals, it's definitely
not something that more advanced users would want to even touch, I mean - relying on software
you bought off Telegram to keep you hidden seems like a bad idea, let's not forget that
law enforcement has a history of targeting and infiltrating anonymisation tools, and
then exploiting them to uncover their users.
You can definitely imagine a scenario where GEOBOX's developer is compromised by law enforcement
who uses the opportunity to roll out a software update with a hidden backdoor.
It'll definitely be interesting to see how the GEOBOX project develops.
Details about a frankly evil Facebook plot to spy on people's web traffic have been revealed
in newly unsealed court documents.
The documents take us back to 2016, back when Snapchat was considered a real threat to Facebook.
At the time, Zucc wrote in an email that, "Whenever someone asks a question about Snapchat,
the answer is usually that because their traffic is encrypted, we have no analytics about them",
[but] "Given how quickly they're growing, it seems ... important to figure out a new
way to get reliable analytics about them".
And so Facebook hatched a plan to get some insider data on Snapchat's users.
They put Onavo on the case, an Israeli mobile analytics company that Facebook acquired in
2013.
And, to give you some context about them, this company was behind 'Onavo Protect VPN'
- a free VPN, that was eventually deemed to essentially be spyware and was shut down in
2019.
So, if anyone knows how to snoop on your web traffic, it's these guys.
Onavo devised a plan called 'Project Ghostbusters' - in an obvious reference to Snapchat's logo.
It involved advertising for a so called "social media research study" with participants being
paid between 10 and 20 dollars, in exchange for giving up some of their data.
But what participants likely didn't understand was the sheer extent of just how intrusive
this study was.
It involved having participants install a 'root certificate' on their phone.
Allowing Onavo to quite literally break the encryption of traffic destined for Snapchat's
servers.
Participants were also made to sideload an app that would redirect Snapchat bound traffic
to Onavo's servers instead, where it would be decrypted and analysed, before being re-encrypted
and sent on its merry way to Snapchat as if nothing, ever, happened.
This is the literal definition of a man-in-the-middle attack, which Facebook themselves acknowledge
in now public emails.
Taking advantage of users who let's be honest are unlikely to have read the terms and conditions,
let alone recognised they were installing spyware is quite frankly evil.
And Facebook knew it!
In newly released internal Facebook emails, their head of security engineering said “I
can’t think of a good argument for why this is okay", "No security person is ever comfortable
with this, no matter what consent we get from the general public.
The general public just doesn’t know how this stuff works.”.
But regardless of internal concerns, instead of shutting down project Ghostbusters, Facebook
expanded it!
They started intercepting YouTube and Amazon traffic as well, and the project was renamed,
the "In-App Action Panel".
It's alleged in court documents that this was all blatantly criminal and violated the
'WireTap Act'.
However, a Meta spokesperson spawned to give their side of the story, and they said "there
is nothing new here—this issue was reported on years ago."
I can only assume they're to the fact that this story first surfaced in 2019, but...
the latest revelations reveal a bunch of unseen internal Facebook communication.
And, I just can't get over the fact that their response here, is basically, "Who, cares?
You already knew we're evil".
As always thanks for watching and I'll see you in the next video have a good one.