
<amp-img src="/blog-content/july-2022/070722/phone-screen.jpg" layout="responsive" width="2000" height="1471" alt="phone-screen">
</amp-img>
<img src="/blog-content/july-2022/070722/phone-screen.jpg" layout="responsive" width="2000" height="1471" alt="phone-screen">
</img>

Recent news has come from Apple concerning an ad company here in the US. Many costumers are alarmed with the news that your lock screen could be the next battleground for your eyes.

No longer merely satisfied with forcing advertising on us in every other part of life, companies are now planning to release apps and services that will show "information" on our phone lock screen. As the lock screen is now at the center of iOS 16, that’s not a great development if it goes anywhere.

Furthermore, if we weren’t already disturbed enough with alerts and notifications, we may never be able to escape them when using certain games or apps!

## Attention economy

Phone users are in the center of the attention economy and the battle is heating up.

Companies like [Glance](https://www.glance.com/) will be releasing an Android app soon that will serve curated content on Android lock screens. It is already present on over 400 million smartphones in Asia and is coming to the US.

In Asia, the Glance app presents a carousel of news, current affairs, ads and other content on user’s lock screens. So far, so convenient. As if opening an app or a browser to find news is so difficult.

Add Apple’s reinvention of the lock screen in iOS 16 and its intent to offer a more interactive lock screen with similar news feeds or similar features.

So far, everyone involved in this business has tried to paint it positively - a way for us to access essential information quickly and with minimal effort. But we all know that’s not what they want. They want to be able to reach us whether we interact with a device or not. They also want us to become passive consumers, content with reading information they send us and getting us out of the habit of finding things out for ourselves.

You don’t need us to tell you how dangerous that can be!

Hopefully, these new apps will be opt-in and can be uninstalled. Otherwise, I suspect it might be a good time to invest in jailbreaking software, as that market is likely to explode in popularity, and possibly even necessity.


Corporations are Gunning for your Lock Screen


<amp-img src="/blog-content/july-2022/070622/shadow-id.png" layout="responsive" width="2000" height="1460" alt="shadow-id">
</amp-img>
<img src="/blog-content/july-2022/070622/shadow-id.png" layout="responsive" width="2000" height="1460" alt="shadow-id">
</img>

While the term may seem ominous, ‘shadow IDs’ are being used in every company everywhere. They were brought into the mainstream when JPMorgan was fined $200 million in December 2021 for allowing their staff to use them.

A shadow ID is a user profile on shadow IT. That’s simply applications or programs installed and used on company hardware without company consent.

In the case of JPMorgan, it was WhatsApp installed on their own devices and used at work to discuss company business.

While this is an extreme example, employees being fined for using their own app on their own devices, it brings to light a common vulnerability in enterprise networks that not everyone is aware of.

Unsanctioned applications running on the company network that the IT department doesn’t know about.

This can be largely prevented by using user profiles that lack installation privileges but with portable apps being able to run from USB or other portable storage, it’s a constant battle to keep a network ‘clean’.

## Remote working and shadow IT

The rise of remote working and the pandemic saw a sharp rise in shadow IT. Existing programs weren’t always up to remote working and approvals were slower than usual.

Plus, remote workers were often granted admin rights to their devices to help troubleshooting.

Both these things contributed to a rise in shadow IT use. Use that probably continues today even though most of us are returning to the office.

## How to tackle shadow IT

The main challenge with shadow IT is that most network monitoring tools cannot identify it. They are designed to detect malicious code and traffic and won’t always be able to tell whether traffic is from legit IT or shadow IT.

The best strategy is to use education and clear policies to inform staff and managers of the risks.

You can streamline IT approval processes and make it much easier to use preferred apps legitimately and utilize a SaaS solution that provides commonly used shadow IT applications legitimately within your network.

The vast majority of staff would prefer using legit software over apps they know they shouldn’t be using, so this can be very effective at tackling this phenomenon.

Remember, the goal with eliminating shadow IT is to reduce threat vectors and vulnerability, not preventing staff using their preferred apps.

Integrate that thinking into your approach and you could drastically reduce the risks presented and secure your network just a little more effectively.


How Many Shadow IDs are your Employees Using?


<amp-img src="/blog-content/july-2022/070522/mars-rover.jpg" layout="responsive" width="2000" height="1600" alt="mars-rover">
</amp-img>
<img src="/blog-content/july-2022/070522/mars-rover.jpg" layout="responsive" width="2000" height="1600" alt="mars-rover">
</img>

While not technically the security news you’re used to from us, this is too good a discussion to miss out on. Did you know the European Space Agency’s (ESA) Mars Express spacecraft uses a Windows 98-based operating system?

If you remember working with Windows 98, which I do, you’ll remember what a security nightmare it was.

It required numerous third-party programs to help protect it: a firewall, antivirus software, and malware scanner, maybe even more!

## Mars Express spacecraft and Win 98

Now we learn that the Mars Express spacecraft got all the way to Mars while using Win 98 without it crashing or being hacked - quite the feat indeed!

What’s more, the ESA, or specifically the Istituto Nazionale di Astrofisica (INAF) in Italy, are planning their own over-the-air update to upgrade the camera.

Air is technically incorrect for something in space, but you get the idea.

The upgrade is apparently targeting the craft’s camera which is being used to try to identify water on Mars. It will help improve the level of detail the camera is capable of, giving us a much better view of Mars and what makes up the surface.

According to ESA, The Mars Advanced Radar for Subsurface and Ionospheric Sounding (MARSIS) is the equipment getting the update. It sends radio waves down into the ground using an antenna to help detect what’s underneath. It’s a bit like ground penetrating radar, where the waves reflect back of different elements in the ground, giving us a picture of what’s there.

Andrea Cicchetti, the MARSIS deputy principal investigator and operation manager at INAF, gave the following statement:

> "Previously, to study the most important features on Mars, and to study its moon Phobos at all, we relied on a complex technique that stored a lot of high-resolution data and filled up the instrument’s on-board memory very quickly. By discarding data that we don’t need, the new software allows us to switch MARSIS on for five times as long and explore a much larger area with each pass.”

## Living with Windows 98

Living with Windows 98 was no easy task back when it was the main OS from Microsoft. It was a full time job keeping it running and secure, a job which I don’t imagine has gotten any easier 24 years later.

It’s surprising that a spacecraft is using such old technology, and something as flaky as Win 98, but they must have made it work somehow as it’s on Mars and working fine.


The Mars Probe Still Using Windows 98


<amp-img src="/blog-content/july-2022/070122/windows-computer.jpg" layout="responsive" width="2000" height="1333" alt="windows-computer">
</amp-img>
<img src="/blog-content/july-2022/070122/windows-computer.jpg" layout="responsive" width="2000" height="1333" alt="windows-computer">
</img>

Let’s be honest, Windows 11 hasn’t gotten off to the best start. Anyone who has been around long enough for older Microsoft OS releases will remember that there used to be a lot more fuss and fanfare.

Windows 11 kind of released with a whimper - very few people noticed it happened at all. Soon, though, there will be a good reason to upgrade.

## Smart App Control

Windows 11 Smart App Control will be built directly into the Windows core and will help protect devices from rogue apps, reducing the number of programs in the store that do more harm than good.

The technology uses code signing in conjunction with an AI process to protect users from rogue apps. According to Microsoft:

> Smart App Control goes beyond previous built-in browser protections and is woven directly into the core of the OS at the process level. Using code signing along with AI, our new Smart App Control only allows processes to run that are predicted to be safe based on either code certificates or an AI model for application trust within the Microsoft cloud.

While still in development, Windows 11 Smart App Control seems to be looking good.

There is a catch though. In the current version, once the system detects an app it doesn’t like, it blocks it and there’s no way to restore it. That will likely change once a release version is ready, but it renders the evaluation version a little too dangerous to use right now in case it gives a false positive.

## Reinstall Windows

Having to reinstall Windows from scratch is a definite downside, but not the showstopper it used to be.

Reinstalling Windows used to be a regular process to keep the OS running smoothly and to stop it becoming bogged down with config settings and apps.

Since Windows 10, that has become a thing of the past, with the OS being much better at managing resources. Plus, the rise of cheaper SSDs means Windows has a significant performance boost without it actually having to do anything.

Once released and working properly, we imagine Windows 11 Smart App Control will provide reassurance that Windows is safe. Combined with your own precautions, it’s a big step forward in security and protection against infected apps.


Will this New Windows 11 Feature Significantly Enhance Protection?


<amp-img src="/blog-content/june-2022/062922/iphone-vs-android.jpg" layout="responsive" width="2000" height="1333" alt="iphone-vs-android">
</amp-img>
<img src="/blog-content/june-2022/062922/iphone-vs-android.jpg" layout="responsive" width="2000" height="1333" alt="iphone-vs-android">
</img>

This question was prompted by a spirited discussion between a friend and I over the various pros and cons of Apple versus Android. One point that was made was that Android needs a third-party VPN for security while Apple has Private Relay.

This, of course, raises the question: is Apple's Private Relay a proper VPN?

In short - no. It’s more like a simplified TOR or proxy than a VPN.

## Apple’s Private Relay

If you have an iCloud+ account, you’ll get a feature called Private Relay. It isn’t part of iOS but can be installed as part of the service.

What Private Relay is, is more security. It falls short of a full VPN though. It can obfuscate your IP address like a VPN can, but only if you use Safari. If you use another browser, it won’t protect you.

Private Relay uses a pair of private servers that act like a proxy to hide your real IP address. It integrates geo-spoofing to hide when you’re surfing from too.

This is a big selling point for Private Relay as it can enable you to access geolocked content without requiring a VPN. That being said, it doesn’t encrypt or protect your traffic anywhere near as securely as a VPN though.

If you're more curious about VPNs, what they are, and how they work, check out [this article we wrote](https://redact.dev/blog/what-are-vpns-and-what-are-they-useful-for) about that very topic!

## Do you need a VPN for your iPhone?

We would suggest you do need a VPN for your iPhone, for any type of phone in fact.

VPNs are designed to protect your privacy. They not only hide your IP address like Private Relay, they also encrypt all your traffic, prevent you being tracked or followed online and anomymizes your traffic as much as possible.

Some VPNs offer added extras such as dedicated IP addresses, multiple-hop connections, split tunneling, VPN kill switches and other neat tools. However, it’s the encryption you really need. Especially if you regularly use open WiFi in coffee shops, airports and other public spaces.

You never know when somebody is watching and only a VPN can keep you properly secure. If you're curious about which VPNs are the best, check out [this article we wrote awhile back](https://redact.dev/blog/top-four-vpns-in-2021)!

Private Relay is a useful feature for sure, but it’s no replacement for a VPN. Fortunately, it isn’t marketed as one so there should be no confusion.


Do You Need a Third-Party VPN for Your iPhone?


<amp-img src="/blog-content/june-2022/062722/bluetooth-device.jpg" layout="responsive" width="2000" height="1333" alt="bluetooth-device">
</amp-img>
<img src="/blog-content/june-2022/062722/bluetooth-device.jpg" layout="responsive" width="2000" height="1333" alt="bluetooth-device">
</img>

We don’t know about you, but we use Bluetooth all the time. Earbuds, keyboard, mouse, speakers, soundbar, even a connection to our car's audio system.

But did you know your phone’s Bluetooth signal can be ‘fingerprinted’ so you can be tracked while it’s in use?

We didn’t either, until recently.

A new paper from the University of California San Diego called "[Evaluating Physical-Layer BLE Location Tracking Attacks on Mobile Devices](https://cseweb.ucsd.edu/~schulman/docs/oakland22-bletracking.pdf)" says there’s a "unique physical-layer fingerprint" to every phone that uses Bluetooth.

This fingerprint is apparently due to flaws in chipset hardware that enables each to be unique.

If someone has the right radio sniffer that can pull apart Bluetooth signals, it can fingerprint individual Bluetooth chips and follow it around wherever you go.

## Carrier frequency offset and IQ imbalance

The fingerprinting happens thanks to carrier frequency offset and IQ imbalance created by combination WiFi and Bluetooth chips in most phones.

As each combination is unique for every chip, in theory at least, that uniqueness can be used to create a fingerprint and therefore, identify that individual chip wherever it appears.

According to the researchers:

> Since BLE devices have temporarily stable identifiers in their packets (i.e., MAC address), we can identify a device based on the average over multiple packets, increasing identification accuracy.

## Don’t ditch Bluetooth yet

Don’t ditch Bluetooth just yet though. The technique requires specialist equipment and knowledge.

That becomes almost impossible in areas where a lot of Bluetooth devices are operating at the same time, like in a mall, train station, airport, or college for example.

The tracker would need to capture, analyze and identify each individual chip, identify the carrier frequency offset and IQ imbalance, mark it and be able to trace it. That’s not something the average Joe could do.

It is a flaw in the system though and should make you think twice about leaving Bluetooth activated when not in use.

We will certainly be thinking twice about using it when we don’t need it anyway!


Bluetooth Signals can be Used to Track Smartphones


<amp-img src="/blog-content/june-2022/062522/check-the-time.jpg" layout="responsive" width="2000" height="1333" alt="check-the-time">
</amp-img>
<img src="/blog-content/june-2022/062522/check-the-time.jpg" layout="responsive" width="2000" height="1333" alt="check-the-time">
</img>

Apparently, once they have found a way in, cyber criminals are spending up to 36% longer within corporate networks than they used to.

Rather than a quick in and out with as much data as they can carry, hackers are now ignoring the proverbial police scanner and spending a lot more time seeing what they can steal.

A report from Sophos, shows that criminals are spending a lot longer within networks once they gain access. That’s both good and bad news for security admins.

It’s good news as it gives admins longer to identify and track cyber criminals. It’s not-so good news because it gives criminals more time to fully breach security and harvest much more usable data.

## Cyber criminals and dwell time

According to the report, cyber criminals who hack rather than use ransomware spend up to 51 days inside networks of small businesses.

If a criminal uses ransomware, they spend on average 15 days inside the network.

The more employees a company has, the shorter the dwell time. Presumably because larger organizations have better security and surveillance.

Sophos attributes this increase to IABs, Initial Access Brokers. These are hackers who sell access to company networks for a price on the dark web.

A potential criminal rents or buys access to a given company for a given amount of time. During that time, the criminal can do what they like as long as they minimize their visibility and chances of being caught.

Using IABs means more people with fewer skills can access company networks. A criminal could potentially put more time and effort into the exploitation and data harvesting tasks rather than intrusion.

## Microsoft Exchange gateways

The Sophos report also mentioned the vulnerabilities in Microsoft Exchange as a serious threat to cyber security. As most companies use a version of Exchange, this could be a very pervasive threat vector and something every network needs to protect against.

Microsoft is taking these threats so seriously they have delayed the new version of Exchange by up to 4 years while teams work to fix the vulnerabilities.

While that’s scant comfort to networks already breached, it does show companies do take these threats seriously.

It also shows you cannot depend on a single vendor to provide all your security and that defense in depth really is the way forward.


Cyber Criminals Spending Longer than Ever Inside our Networks


<amp-img src="/blog-content/june-2022/062322/german-government-privacy.jpg" layout="responsive" width="2000" height="1223" alt="german-government-privacy">
</amp-img>
<img src="/blog-content/june-2022/062322/german-government-privacy.jpg" layout="responsive" width="2000" height="1223" alt="german-government-privacy">
</img>

Recently, [we wrote an article](https://redact.dev/blog/new-eu-law-would-mandate-chat-app-scanning-for-child-abuse) about the problematic new policy on the docket in the European Union allowing government agencies to surveil users. While ostensibly this is for a good cause, its knock on effects are disturbing from a privacy perspective, to say the least.

If the EU law were to come to pass, it would set the precedent that, as long as the threat is big enough, any right to privacy citizens in Europe may have is ultimately irrelevant. Once established, it’s not too far a stretch to imagine certain religious or political identities being quashed with such laws.

That being said, a new leaked document out of Germany seems to suggest that not all European member states are on board with this shift.

## The German Political Situation

As you may be aware, the German government has gone through quite the shift recently. After 16 years of leadership, Angela Merkel resigned in 2021. A long term member of the center right party, the Christian Democratic Union, she was succeeded by Olaf Scholz of the center left Social Democratic Party.

This shift in political alignment in the country comes with many effects, including a stated commitment to the privacy rights of every German citizen. With this in mind, the government has drafted a list of questions it intends to present to the commission responsible for proposing this new policy.

What comes after that is not so clear. If the answers the commission gives fail to meet the German government's standard to the right to encryption, it’s possible that they’ll oppose the bill fully, demand it get revised, or even do nothing.

## The Document Itself

All of this discussion of the circumstances that the document arose out of has lost sight of the core of the news - the list of questions Germany will bring to the table.

The list is rather quite long, and enumerating all 61 questions is unnecessary. Instead, we’ll provide a thematic summary of what kinds of questions will be asked.

1. How are you planning on implementing these scanning features, and how are they actually predicted to further the stated goals?
2. Is the possible destruction of end-to-end encryption on chat apps actually going to decrease the amount of CSAM in circulation?
3. How are citizens going to interact with this system, especially when there are errors made in reporting?
4. How does this system work with Europol?

We’ll have to wait and see how the full list of questions gets answered, but we hope that the law is not passed in the form it seems to be in right now.


Our cat diaries

Corporations are Gunning for your Lock Screen • 2022-07-07

How Many Shadow IDs are your Employees Using? • 2022-07-06

The Mars Probe Still Using Windows 98 • 2022-07-05

Will this New Windows 11 Feature Significantly Enhance Protection? • 2022-07-01

Do You Need a Third-Party VPN for Your iPhone? • 2022-06-29

Bluetooth Signals can be Used to Track Smartphones • 2022-06-27

Cyber Criminals Spending Longer than Ever Inside our Networks • 2022-06-25

Leaked German Memo Raises Questions about Privacy in Europe • 2022-06-23