Hacking: What you can do

Hackers can do incredible damage to businesses and contrary to what is often thought, hackers don’t only go after large corporations with vast amounts of credit card data and e-mail addresses. They go after tiny outfits too and after people like you and me. Below are a few things you need to know about hacking.

Picture of me 1-crop4In 2009, British police was given the power to hack into personal computers without a court warrant. It is called remote searching. You can read more about it in this article in The independent. By the way, it ends with this important bit of information:

The European Court of Human Rights has ruled that Britain’s policy of retaining samples from people never convicted of a crime – including children – breaches human rights.

However, there have also been reports that the British police runs hopelessly behind with regard to fighting cyber crime, because it lacks the knowledge and technology (see here). “The police are becoming more aware of the cyber threat, but remain behind in terms of their own technology, knowledge and intelligence”. How does this add up? To police not being able to do much, in practice. Cyber crime investigations are expensive and require the kind of expert knowledge few people possess.

The least you can do?

  • Always cover your web cam when it’s not in use. Read more about web cams and hacking here and here.
  • Never tell anyone you do not really know what computer equipment you have and what software you run. The chances that you are talking with a hacker may be slim, but if you are, particularly if it is someone you have exchanged e-mail with (meaning that the person has your IP address), the person may not even have to use software intended to test computer security (such as Metasploit) to examine your computer from a distance and then use software like MeterPreter to target the vulnerabilities in your equipment.
  • Be aware that any e-mail you receive may be spoofed. Faked. There is no way to tell whether an e-mail is spoofed or not. E-mail that appears to come from a potential new client may contain a link that causes you to download code (and even the mail itself may contain code). Do a web search instead of clicking on the link and call that possible new client instead of e-mailing back.
  • If you are in the habit of filling out online surveys to make an extra few pennies, mail announcing a new survey can be spoofed too. Keep that in mind before you announce to the world (Facebook, Twitter) that you are filling out online surveys. Such an e-mail can then take you to the computer of a hacker who can ask you to tell him or her truthfully what kind of computer equipment you are using and all sorts of other things he or she wants to know.
  • Internet traffic can be redirected with internet port relay software. I don’t know how exactly it works. If you know what a traceroute is and suspect that some of your traffic is being rerouted, run a traceroute and direct its output to your printer (so that you have a hardcopy that cannot be tampered with). A traceroute can be redirected as well, however. Having traceroute results that show tampering is no good for police, but it can tell you that you are not going paranoid after all. That’s worth a lot.
  • If you use Facebook, Skype or anything else that has a chat possibility, use it on one specific piece of equipment, not on your main computer if you want to keep that computer safe. If you use anything with a chat feature on your main computer, it provides a hacker with a direct conduit into your PC. Particularly Facebook seems to be very leaky. If you keep all those social media communications limited to one device that you don’t use for anything else, you can easily reset or reinstall it in the event of a problem (generally without losing any data).
  • If you’ve just had broadband or cable installed and someone calls you claiming to be from your provider asking you any of the numbers on the side of the router or the like, don’t give it to the caller.
  • If you use a mobile phone for business, get several phones and only allow one phone number to be known publicly. That’s like the e-mail address on which you don’t mind getting spam. Use it only to receive calls, from mostly unknown parties. Use a non-published phone number on a different mobile to communicate much more securely with your trusted clients.
  • There is a lot of free and cheap software out there that you really don’t want to know about. Particularly if you have a persistent suitor, ex or an envious competitor, you should be aware, though, that there are all kinds of software that enable someone to modulate his or her voice when they call you or Skype with you, including changing gender. it works well, too.
  • I have no idea how tablets get hacked (Facebook use and hacking of mifi hotspots?), but regularly resetting one’s tablet, always verifying downloads, and backing up or removing personal files regularly is probably a good idea and anyone who tells you that there is not much hackers can do with a tablet still has a lot to learn.
    Below is an example of a tablet hack. You may have to play the (converted) video a few times and watch the tablet screen at the beginning to see that the tablet screen is filling up all by itself. There were pages and pages and pages of the stuff. The original recording is 7 seconds long and is continuous but has a bit rate of 64 kbps; the converted file seems to consist of only three images.

In spite of what most people think, though, many hackers are good for society and some may even help you on occasion.

Facebook in trouble?

Facebook appears to know it is in trouble over the experiment it conducted (see previous post). On CNN, I read this morning that a spokesperson said it was research “to improve our services”.

It looks like Facebook is trying to jump through hoops. But Facebook doesn’t fit through the hoops.

When users consented to their data being used to improve Facebook’s services, most users will have assumed that this referred to services provided to the users, not services Facebook provides to advertisers. (When you’re happy, you are more optimistic, hence more likely to click on advertisements. Pessimists have a more realistic view of the world than optimists, but optimists likely see themselves as more successful than pessimists.)

And when Facebook users consented to their data being used to improve the services, they sure as hell did not consent to psychological experiments being conducted on them.

They may have expected Facebook to analyse the data and make use of the results of those analyses, yes, but they were likely thinking in terms of technology or something along those lines. Upgrading server x that delivers Facebook to country y. They may also have expected to see baby products being advertised to those who clicked on such ads and posted baby pictures, and office products being shown to people who stated that they are self-employed.

Facebook tweaking the streams of users to bring them the items it thought users wanted to see, that is one thing. I can be annoyed about Facebook not showing my friends’ posts in my timeline, no matter how many boxes I tick to try and get them to show and I can be annoyed about commercial posts I get shown no matter how many boxes I tick in an attempt to get rid of posts about products I cannot even buy because I am many miles away on the other side of the world, but that is an entirely different ballpark compared with Facebook deliberately tweaking the streams of users to make them feel happy or make them feel miserable, or even attempting to see whether it can or not.

Facebook – and the two university researchers along with it – has crossed a line, again. This time, Facebook has made an unforgivable mistake.

It is true that other media manipulate us all the time. But we expect that. We know that the BBC only reports what it wants to report and does not present an objective overview of society. We know that commercials feed us bullshit, that buying that car or buying that dress or perfume won’t make glamorous models suddenly find us irresistible. And I know that when CNN – CNN Money, that is – writes that “it does not appear that Facebook faces any legal implications”, CNN is trying to manipulate its audience too.

That does not apply when it comes to messages from our friends. It may still be true that we have one or two friends – or children – who may consciously or subconsciously try to manipulate us, but when it comes to messages our friends post combined, we do not expect those messages to be manipulated by a third party in such a way that we become happier. And we certainly don’t expect our Facebook streams to be manipulated to make us miserable.

Happy or sad?

 

Facebook could have conducted this experiment equally well after explaining what it wanted to do and allowing users informed consent. It chose not to.

The US Army provided some of the funding for this experiment. That does not help.

I have meanwhile realised how Facebook may be able to get away with this in a court of law. Facebook could claim that it was carrying out this experiment because it was concerned about the number of suicides and other problems precipitated by bullying on Facebook. It could say that it was trying to figure out how it could tweak the streams of its users to prevent such problems for its users. Unless some whistleblower provides evidence to refute this, that might very well work.