Oops

Another round of OpSec training

anyway, but even that had a joke of opsec.

Not as insane as it was in the early 2000s…

> while link-layer encryption has been standard practice in satellite TV for decades

Before Snowden, I would say 99% of ALL TCP traffic I saw on satellites was in unadulterated plain-text. Web and email mostly.

… the pipe was so fast, you could only pcap if you had a SCSI hard drive!

This is why NSA asked for (and got from SGI) a guranteed rate I/O API - to make sure that whstever the signal intelkigence platform sensors captured could be written to storage.

SMS was also a bit like this in its early days and you could read them coming off the local cell (also true of calls at a certain time, but I didn't see much of this).

I just did a quick search and apparently many pagers in the UK are still running cleartext POCSAG! https://www.reddit.com/r/RTLSDR/comments/1asnchu/are_uk_page...

>we re-scanned with their permission and were able to verify a remedy had been deployed: T-Mobile, WalMart, and KPU.

The fact that critical infrastructure (e.g. utility companies using satellite links for remote-operated SCADA) was exposed is really scary too.

Really serious security risks in critical/industrial infrastructure are ... numerous. And these aren't complex vulnerabilities, these are leaving the door open with default passwords, unencrypted traffic, and that sort of thing.

Also a fun fact: For a long time it was only semi-officially known that the BND owned and operated the site. Officially it was called "Long distance telecommunications station of the Bundeswehr" and operated by the "Federal Office for Telecommunications Statistics"

Officially it has been transferred to the BND; experience suggests all data from there still goes straight back to Fort Meade… (And in exchange the BND gets some morsels back on people _they_ are not allowed to spy on publicly.)

URI's leak company secrets. I'm sure there's some people at Google using Edge which are leaking company data to Microsoft. I'm sure there's some people at Microsoft using Chrome which are leaking data to Google.

Edge and Chrome both send back every URI you visit to "improve search results" or to "sync history across devices". It's not clear if this includes private mode traffic or not (they don't say).

Huge privacy hole to allow this, and nobody seems to be aware or care.

They do have privacy policies which say they won't sell that data, or use it for advertising or anything other than delivering the service. But - who knows if that is true? There's no oversight. And if they get caught breaking that privacy policy, who has the appetite these days to do anything meaningful in terms penalties? Nobody.

> who knows if that is true? There's no oversight

The oversight is that those companies rely heavily on being trustworthy, and proving untrustworthy would be disastrous for their business models. Companies don't have to care right now because they have reason to believe Google, MS, et. al. aren't sniffing that data. If they came to believe they were?

Google alone is making $43 billion on Cloud and would prefer not to jeopardize that revenue stream.

The reason why this does not result in a significant loss of usage is because trustworthiness-usage is not a linear function or a even a continuous function -- it is a step function. To cause less usage, the loss-of-trust force has to be higher than the networking effect force. Otherwise, behavior does not change.

That's what I don't get - security and compliance people are paranoid.

This is the kind of thing they shouldn't be requiring evidence to care about, given the rest of their job is about the "what-ifs". Just seems crazy to me.

> there's some people at Google using Edge

I'd be surprised if it's more than a handful of people with explicit exceptions for work-related tasks. Chrome is the norm.

Was thinking about this as well. What evidence would it realistically leave? I mean - they are sending the uri's by default so no client side reverse engineering is needed. They say plainly they are doing this.

Yes, it's a lot of traffic.

IP spaces are well known. Easy to filter for corporate traffic. From there, it's a smorgasbord of internal URI's to dig through - anything with no domain name, or host.(companyname).com traffic. Also easy.

Maybe this ends up in a big data lake queryable by certain groups, but not anyone likely to spill the beans. NDA covers you there. This is not New York Times level corporate subterfuge. It's almost certainly not legal - and this is the important thing - the regulators haven't had the gumption to prosecute anti-competitive behavior in earnest since the 70's or earlier. What Microsoft went through in the 90's in retrospect was antitrust litigation with kid gloves on.

This armchair analyst sees no downside to such practices. Risk, but so little it doesn't matter.

Sure, insiders could spill the beans and violate their NDA's, but who the fuck is going to do more than levy a slap on the wrist for something too difficult to explain to Congress in a way that gets them to care?

Now, I think if you actually put your hands on the browsing history of congressmen harvested in this way, and put it into the public domain, you're going to get a bunch of regulators to all of a sudden care about antitrust enforcement again.

Also, evidence doesn't have to be externally visible. In a lawsuit discovery will dig through design docs, server logs, emails, chats, everything.

That leaves a huge internal paper trail - the kind of thing that shows up during discovery in a lawsuit.

No, companies like that are not doing this kind of shit, it's not worth it.

The new German ecard patient system is also trivial to hack, as shown multiple times on CCC. As long as no one goes to jail, they will continue like this.