
<amp-img src="/blog-content/june-2022/062522/check-the-time.jpg" layout="responsive" width="2000" height="1333" alt="check-the-time">
</amp-img>
<img src="/blog-content/june-2022/062522/check-the-time.jpg" layout="responsive" width="2000" height="1333" alt="check-the-time">
</img>

Apparently, once they have found a way in, cyber criminals are spending up to 36% longer within corporate networks than they used to.

Rather than a quick in and out with as much data as they can carry, hackers are now ignoring the proverbial police scanner and spending a lot more time seeing what they can steal.

A report from Sophos, shows that criminals are spending a lot longer within networks once they gain access. That’s both good and bad news for security admins.

It’s good news as it gives admins longer to identify and track cyber criminals. It’s not-so good news because it gives criminals more time to fully breach security and harvest much more usable data.

## Cyber criminals and dwell time

According to the report, cyber criminals who hack rather than use ransomware spend up to 51 days inside networks of small businesses.

If a criminal uses ransomware, they spend on average 15 days inside the network.

The more employees a company has, the shorter the dwell time. Presumably because larger organizations have better security and surveillance.

Sophos attributes this increase to IABs, Initial Access Brokers. These are hackers who sell access to company networks for a price on the dark web.

A potential criminal rents or buys access to a given company for a given amount of time. During that time, the criminal can do what they like as long as they minimize their visibility and chances of being caught.

Using IABs means more people with fewer skills can access company networks. A criminal could potentially put more time and effort into the exploitation and data harvesting tasks rather than intrusion.

## Microsoft Exchange gateways

The Sophos report also mentioned the vulnerabilities in Microsoft Exchange as a serious threat to cyber security. As most companies use a version of Exchange, this could be a very pervasive threat vector and something every network needs to protect against.

Microsoft is taking these threats so seriously they have delayed the new version of Exchange by up to 4 years while teams work to fix the vulnerabilities.

While that’s scant comfort to networks already breached, it does show companies do take these threats seriously.

It also shows you cannot depend on a single vendor to provide all your security and that defense in depth really is the way forward.


Cyber Criminals Spending Longer than Ever Inside our Networks


<amp-img src="/blog-content/june-2022/062322/german-government-privacy.jpg" layout="responsive" width="2000" height="1223" alt="german-government-privacy">
</amp-img>
<img src="/blog-content/june-2022/062322/german-government-privacy.jpg" layout="responsive" width="2000" height="1223" alt="german-government-privacy">
</img>

Recently, [we wrote an article](https://redact.dev/blog/new-eu-law-would-mandate-chat-app-scanning-for-child-abuse) about the problematic new policy on the docket in the European Union allowing government agencies to surveil users. While ostensibly this is for a good cause, its knock on effects are disturbing from a privacy perspective, to say the least.

If the EU law were to come to pass, it would set the precedent that, as long as the threat is big enough, any right to privacy citizens in Europe may have is ultimately irrelevant. Once established, it’s not too far a stretch to imagine certain religious or political identities being quashed with such laws. 

That being said, a new leaked document out of Germany seems to suggest that not all European member states are on board with this shift.

## The German Political Situation

As you may be aware, the German government has gone through quite the shift recently. After 16 years of leadership, Angela Merkel resigned in 2021. A long term member of the center right party, the Christian Democratic Union, she was succeeded by Olaf Scholz of the center left Social Democratic Party. 

This shift in political alignment in the country comes with many effects, including a stated commitment to the privacy rights of every German citizen. With this in mind, the government has drafted a list of questions it intends to present to the commission responsible for proposing this new policy. 

What comes after that is not so clear. If the answers the commission gives fail to meet the German government's standard to the right to encryption, it’s possible that they’ll oppose the bill fully, demand it get revised, or even do nothing. 

## The Document Itself

All of this discussion of the circumstances that the document arose out of has lost sight of the core of the news - the list of questions Germany will bring to the table. 

The list is rather quite long, and enumerating all 61 questions is unnecessary. Instead, we’ll provide a thematic summary of what kinds of questions will be asked. 

1. How are you planning on implementing these scanning features, and how are they actually predicted to further the stated goals?
2. Is the possible destruction of end-to-end encryption on chat apps actually going to decrease the amount of CSAM in circulation?
3. How are citizens going to interact with this system, especially when there are errors made in reporting?
4. How does this system work with Europol?

We’ll have to wait and see how the full list of questions gets answered, but we hope that the law is not passed in the form it seems to be in right now. 


Leaked German Memo Raises Questions about Privacy in Europe


<amp-img src="/blog-content/june-2022/062222/tiktok.jpg" layout="responsive" width="2000" height="1333" alt="tiktok">
</amp-img>
<img src="/blog-content/june-2022/062222/tiktok.jpg" layout="responsive" width="2000" height="1333" alt="tiktok">
</img>


With over [1 billion monthly active global users](https://wallaroomedia.com/blog/social-media/tiktok-statistics/), TikTok has rapidly become one of the quintessential social media platforms alongside giants like Facebook (now Meta) and Twitter. However, immense growth does not come without immense risks- such as the enormous breach in the company’s trust that was recently reported.

## TikTok: The Ticking Timebomb

TikTok is not new to the whole data privacy game. In fact, they have been [responding to questioning](https://newsroom.tiktok.com/en-us/statement-on-tiktoks-content-moderation-and-data-security-practices) regarding the security of their user’s data for years. Despite this, however, [leaked audio](https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-tapes-us-user-data-china-bytedance-access) from more than 80 internal meetings within the organization suggest that China-based employees have accessed nonpublic data about TikTok users from the United States on more than one occasion.

The audio consists of 14 recordings from nine different TikTok employees, all of which indicates that engineers located in China had access to American user data from at least September 2021 to January 2022. The recordings vary from small group meetings among executives to much larger presentation meetings.

## A Potential Fix

In the outbreak of this information, TikTok spokesperson Maureen Shanahan made one, short statement: 

> “We know we’re among the most scrutinized platforms from a security standpoint, and we aim to remove any doubt about the security of U.S. user data. That’s why we hire experts in their fields, continually work to validate our security standards, and bring in reputable, independent third parties to test our defenses.”

And there is something to support that testimony- Project Texas. [Project Texas](https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-project-texas-bytedance-user-data) is a contract currently being negotiated between TikTok, the cloud services provider Oracle, and the Committee on Foreign Investment in the United States (CFIUS).

In the agreement, TikTok would hold specific data coming from U.S. users, such as their phone numbers and birthdays, exclusively at a data center operated by Oracle within the state of Texas. That data would then *only* be accessible to U.S.-based TikTok employees.

While this might sound like a good start, there is still much work to be done, primarily in deciding what type of data would be “protected.” As of right now, the recordings suggest that all *public* data, such as a users’ public profile and what they post, are *not* considered as such.

## You are Your Best Defense

Overall, you are your best defense from those hungry for your data, but that is also a very tough job to do. That is why we at Redact want to make it easier for you to have more control over your own information on the Internet.

At bare minimum, you can protect yourself by controlling what you post online, which is [extremely beneficial](https://redact.dev/blog/why-is-deleting-old-posts-so-important). And if you’ve already posted stuff that you want to get rid of, don’t worry! We’ve got you covered.

You can use Redact to delete thousands of unnecessarily revealing social media posts, direct messages, and even emails within minutes! So, what are you waiting for? Download Redact for **free** right this moment at [redact.dev/download](https://redact.dev/download).





Leaked Audio Reveals U.S. TikTok Data was Accessed from China


<amp-img src="/blog-content/june-2022/062122/microsoft-vulnerability.jpg" layout="responsive" width="2000" height="1333" alt="microsoft-vulnerability">
</amp-img>
<img src="/blog-content/june-2022/062122/microsoft-vulnerability.jpg" layout="responsive" width="2000" height="1333" alt="microsoft-vulnerability">
</img>

Microsoft recently announced they had detected some critical vulnerabilities in a mobile framework used by Android. 

The [Microsoft 365 Defender Research Team](https://www.microsoft.com/security/blog/2022/05/27/android-apps-with-millions-of-downloads-exposed-to-high-severity-vulnerabilities/) detected flaws in a framework operated by mce Systems last year. The vulnerabilities have been patched now, so are no longer a threat, but did provide full access to phones for a while.

It apparently wasn’t just the framework, some apps also carried a vulnerability that could be leveraged by a hacker. That vulnerability passed checks run by the Google Play Store. In fact, the vulnerabilities were so serious, they had a CVSS score of between 7.0 and 8.9. (CVE-2021-42598, CVE-2021-42599, CVE-2021-42600, and CVE-2021-42601).

## Microsoft Swoops In

It’s somewhat ironic that a company known across the globe for security vulnerabilities and providing bugged software managed to spot bugs in more secure software.

But, sometimes, even the mightiest among us make mistakes.

The 365 Defender Research Team were some of the first to identify the vulnerabilities and report them to mce Systems and relevant companies to patch them. 

The vulnerabilities tied into the framework that interfaces with Android to perform self-checks and diagnostics. That gave any potential hacker the opportunity for unrivaled access to an Android phone. Microsoft said the vulnerabilities could “allow adversaries to implant a persistent backdoor or take substantial control over the device".

Fortunately, Microsoft worked with mce Systems to remedy the issue. That, and the process within the Google Play Store that allowed these vulnerabilities through, and the majority of the apps affected have all been fixed.

"We worked closely with mce Systems’ security and engineering teams to mitigate these vulnerabilities," Microsoft said, "which included mce Systems sending an urgent framework update to the impacted providers and releasing fixes for the issues. At the time of publication, there have been no reported signs of these vulnerabilities being exploited in the wild."






Microsoft Identifies Critical Android Vulnerabilities


<amp-img src="/blog-content/june-2022/061922/facebook-alert.jpg" layout="responsive" width="2000" height="1333" alt="facebook-alert">
</amp-img>
<img src="/blog-content/june-2022/061922/facebook-alert.jpg" layout="responsive" width="2000" height="1333" alt="facebook-alert">
</img>


As the most popular social network in the world right now, Facebook is a prime target for hackers and malware. But would you even know if your account had been compromised?

There are a few signs someone else might be using your Facebook account, including:

-	Likes and follows you didn’t make
-	Posts you didn’t write
-	Comments you never made
-	Profiles that look identical to yours but aren’t
-	You’re locked out of Facebook

Some of those are easier to identify than others. You’ll quickly notice (or be notified of) likes, follows, posts, or comments. You may not notice copycat profiles though. That bit comes later.

You may also have received an email from Facebook telling you there was a login from a different location. Don’t depend on that warning though.

## Checking Facebook for activity

The easiest way to see if someone else is using your Facebook account is to check the activity log:

1.	Log into Facebook and select the profile menu at the top right 
2.	Select Settings & privacy and Activity log
3.	Check the log for anything you don’t recognize

The **Activity History** menu on the far left is also a good place to check. It shows everything that has happened using your account in a clear, unambiguous way.

If you do spot something you don’t recognize, or several somethings, change your Facebook account password right away by doing the following:

1.	Log into Facebook and select the profile menu at the top right 
2.	Select **Settings & privacy**, then click on **Settings**
3.	Select **Security and login** on the left-hand-side
4.	Select **Change password** in the **Login** section in the center pane

Once your password has been changed, we also recommend enabling two-factor authentication. This is accessed in the section under **Login**.

You can optionally select to enable alerts for unrecognized logins underneath the two-factor authentication section. This will send an email to verify a login is legit when you try to log in from a location or device you haven’t used before. 

It is important to note that this measure by itself won’t prevent someone using your account once accessed. Instead, it serves as an alarm to notify you as soon as it happens to ensure that you are able to quickly change your password and secure your account.




How to Check if Someone Else is Using Your Facebook Account


<amp-img src="/blog-content/june-2022/061822/hidden-cameras.jpg" layout="responsive" width="2000" height="1333" alt="hidden-cameras">
</amp-img>
<img src="/blog-content/june-2022/061822/hidden-cameras.jpg" layout="responsive" width="2000" height="1333" alt="hidden-cameras">
</img>


Have you heard those stories about [hidden cameras in hotel rooms and Airbnbs](https://www.washingtonpost.com/travel/tips/airbnb-hidden-camera-tiktok/)? If so, the new Lumos system is sure to bring you a huge sigh of relief.

Academics from Carnegie Mellon University have developed an AR system to help identify any hidden cameras as well as other IoT devices. 

It has legit uses as well as looking for spy cameras, but it’s a definite extra benefit if you use Airbnb or unbranded hotels or motels!

## Lumos is quite great...

The system is called [Lumos](https://www.usenix.org/system/files/sec22summer_sharma-rahul.pdf) and is essentially a wireless network sniffer. It can detect wireless traffic being transmitted from the vicinity, which can be a sign of hidden cameras as well as more legit uses.

It can then extrapolate the data it detects and provide an estimated location for the traffic source. All this can then be visualized within an AR interface so you can much better see what’s going on.

It works by sniffing wireless packets and assessing signal strength using Received Signal Strength Indicator or RSSI.

It combines this data with phone location data using visual inertial odometry (VIO) to create an AR picture of the space around you. Finally, it can collect MAC addresses of broadcasting devices to help identify them. It then adds a label to the interface like ‘camera’, ‘plug’ and so on.

It’s a very clever piece of software that could have a multitude of uses, but this is a good use to put it to.

Here’s a short video demonstrating Lumos' functionality:

<iframe width="560" height="315" src="https://www.youtube.com/embed/QwMXiyn-e28" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

"As the user walks closer to each device, the RSSI values corresponding to those data points increase and then reduce as she walks away from the device," the researchers said. "Lumos leverages the spatial measurements of RSSI values and their variations to estimate the location of each device."

## ... But it's not perfect

Lumos is an excellent innovation that will be able to reassure guests that their room isn’t under surveillance. 

It won’t work on wired cameras or those that store data on SC card rather than broadcast it though. Neither will it be able to detect whether the MAC has been spoofed or be able to identify cameras or devices that encrypt their traffic.

However, as the majority of reported incidents of surveillance have used standard web cams so far, this is a definite step forward.

Lumos is not ready for the mainstream yet and is still in development. We’ll keep an eye on the developers and let you know once it’s ready for release.






New System in Development to Detect Hidden Cameras


<amp-img src="/blog-content/june-2022/061622/watching.jpg" layout="responsive" width="2000" height="1333" alt="watching">
</amp-img>
<img src="/blog-content/june-2022/061622/watching.jpg" layout="responsive" width="2000" height="1333" alt="watching">
</img>

Recently, [Mozilla released a blog](https://blog.mozilla.org/security/2021/06/01/total-cookie-protection-in-private-browsing/) outlining the newest way they plan on protecting the privacy of their users. The change in policy is part of a larger sweeping movement across the tech industry. Companies are now more than ever maximizing the privacy and security of their customers - a stark contrast to last decade’s recklessness. 

## The Feature

The feature in question is called “Total Cookie Protection.” Added to the browser in February of this year, it seeks to keep different web services from harvesting, tabulating, and using data that you may not be aware they even have access to.

Before, it was overwhelmingly the case that third party cookies were globally accessible. If you went to Facebook, then to YouTube, then to Amazon, your traffic (purchases, views, likes) on each website were able to be read and stored by each company respectively. This traffic was then used to profile you, show targeted ads, tailor your auto recommendations, and more. 

With Total Cookie Protection, it is no longer possible for these platforms to do this. Each website’s cookies are contained to that space and that space alone. 

## The Policy

While that all sounds great, it doesn’t answer what actually has changed. If this feature has been on the site for months now, why all the fuss?

Well, Mozilla announced that the feature is now the default for all types of tabs, including “Private Windows.” While this represents a relatively small shift, the effects are large.

For any users who don’t keep abreast with tech news and pay attention to every new feature, they’re now grandfathered into this new standard, keeping their activity more safe and secure. Without even knowing about it, every average Firefox user can now browse the web with fewer eyes watching - something we here at Redact are also in the business of. 


This New Firefox Policy is Taking the World by Storm


<amp-img src="/blog-content/june-2022/061522/facebook-lawsuit.jpg" layout="responsive" width="2000" height="1333" alt="facebook-lawsuit">
</amp-img>
<img src="/blog-content/june-2022/061522/facebook-lawsuit.jpg" layout="responsive" width="2000" height="1333" alt="facebook-lawsuit">
</img>

[According to Bloomberg](https://www.bloomberg.com/news/articles/2022-06-08/meta-hit-with-8-suits-claiming-algorithms-hook-youth-ruin-lives#xj4y7vzkg), 8 different lawsuits have been filed against Meta in the last week, the parent company of social media platforms including Facebook, Instagram, and WhatsApp. This is nothing new, and such lawsuits get filed every few months. Is this one any different? 

## The Cases

On their own merits, each lawsuit is very, very weak. They claim that the social media platforms have led to a bevy of health concerns, mental and physical. While it may be the case that social media does indeed lead to problems in these areas, it’s not clear why Meta should be held accountable. 

For instance, nobody is suing alcohol companies for distilling what is essentially neurotoxins that feel good while they slowly kill you. The link between frequent alcohol abuse and long term health effects is clear. 

However, the health consequences are widely understood. If somebody chooses willingly to partake in something everybody knows has negative consequences, the company who sells that thing cannot be sued for your decision. The same must be the case for social media.

## The Discourse

Whether or not these cases actually come to mean anything - and they almost certainly will not - the fact that these appear so commonly points to a conversation that’s being had in society. To quote Tom Brokaw following the Challenger disaster, “We’ll all have to examine what it is that we want from this era of high technology.”

Social media comes with consequences. With unprecedented connectivity, we’re now more able than ever to replace real relationships with virtual ones. We hide in increasingly atomized, isolated islands, incapable of talking to each other the way we used to.

Every human being has a record of every thought they’ve ever deemed meaningful enough to post, every memory a picture has been snapped of, every scheduled meeting, every business letter sent. It’s all archived for all time. 

This unprecedented state of affairs is one that people are increasingly unconvinced is the best way into an ever uncertain future. 


Our cat diaries

Cyber Criminals Spending Longer than Ever Inside our Networks • 2022-06-25

Leaked German Memo Raises Questions about Privacy in Europe • 2022-06-23

Leaked Audio Reveals U.S. TikTok Data was Accessed from China • 2022-06-22

Microsoft Identifies Critical Android Vulnerabilities • 2022-06-21

How to Check if Someone Else is Using Your Facebook Account • 2022-06-19

New System in Development to Detect Hidden Cameras • 2022-06-18

This New Firefox Policy is Taking the World by Storm • 2022-06-16

Meta Hit with Lawsuits, do they have Teeth? • 2022-06-15