On-Prem

Fleeing Facebook app users realise what they agreed to in apps years ago – total slurpage

Zuck takes out full-page ads to apologise as Tim Cook calls for 'well-crafted' privacy laws


It was the weekend that had it all: promiscuous permissions dragged Google into the Facebook privacy row, Facebook apologised again while at the same time denying anything's wrong with its Android apps, and Tim Cook was totally not smug when he chimed into the privacy debate.

It's long been understood by people in tech (less so, El Reg suspects, in the broader public) that Facebook analysed users' interactions in its Social Graph. Doing so is the core of the company's advertising strategy and the purpose of the algorithms that choose what's at the top of users' feeds.

However, when people started deleting their accounts on the weekend, the more sharp-eyed realised Facebook was slurping more than they expected.

New Zealand LLVM developer Dylan McKay got the ball rolling with the following Tweet:

What McKay and others realised to their horror was that Facebook Messenger on Android uploaded far more than expected. Specifically: metadata for phone calls and text messages, even though they were sent with Android's default phone and SMS apps, not Facebook's Messenger apps.

The same kinds of everything-including-the-kitchen-sink permissions apply to the Facebook and Instagram apps.

You were warned: Facebook and Instagram Android app permissions

As Johns Hopkins University cryptographer Matthew Green put it:

Facebook's inflection point: Now everyone knows this greedy mass surveillance operation for what it is

READ MORE

The data slurp included Facebook app users' interactions with others who are not on Facebook – meaning people who never gave the Social Network™ permission for anything are probably profiled in its data troves anyway.

This was already an issue for Web users, with the infamous Facebook cookie the subject of lawsuits in Belgium (Facebook won) and France (Facebook lost).

In January, long-time Facebook antagonist Max Schrems was told he couldn't run a privacy class action in Austria, but individuals could sue in that country. Schrems is conducting a separate and very costly legal battle with Facebook in Ireland.

However, few if any users realised message metadata they believed were private were being uploaded.

As futurist and El Reg columnist Mark Pesce put it:

Pesce also mused on the ethical considerations that accompanied the development of a capability that results in such an extensive data-slurp:

Facebook has responded with a statement saying “uploading call and text history” was always opt-in (unless, of course, you're not a Facebook user, in which case you had no say in the matter).

The post says the data was never offered for sale, and also draws on the “metadata is not data” defence: “When this feature is enabled, uploading your contacts also allows us to use information like when a call or text was made or received. This feature does not collect the content of your calls or text messages. Your information is securely stored and we do not sell this information to third parties. You are always in control of the information you share with Facebook” (emphasis added).

Facebook's other response to the escalating scandal was to take out full-page mea-culpa newspaper advertisements in the UK and USA.

Over Mark Zuckerberg's signature, the ad apologised for the 2014 quiz app at the bottom of the scandal, saying “we're now taking steps to make sure this doesn't happen again”. The rest of the ad text is at follows:

We've already stopped apps like this from getting so much information. Now we're limiting the data apps get when you sign in using Facebook.

We're also investigating every single app that had access to large amounts of data before we fixed this. We expect there are others. And when we find them, we will ban them and tell everyone affected.

Finally, we'll remind you which apps you've given access to your information – so you can shut off the ones you don't want anymore.

Thank you for believing in this community. I promise to do better for you.

Given that Apple has a far less permissive attitude to user privacy, Tim Cook was commendably not-smug when he chimed into the debate.

Speaking at the annual Chinese Development Forum in Beijing on Saturday, Bloomberg quoted Cook as calling for stronger, “well-crafted” privacy regulation.

“The ability of anyone to know what you’ve been browsing about for years, who your contacts are, who their contacts are, things you like and dislike and every intimate detail of your life - from my own point of view it shouldn’t exist”, Cook said.

“We’ve worried for a number of years that people in many countries were giving up data probably without knowing fully what they were doing,” he added. Apple's concern that data would be abused in the form of profiling, with an inevitable user backlash, was a prediction that “has come true more than once”. ®

Send us news
188 Comments

NFTs not annoying enough? Now they come with wallet-emptying malware

Plus rifle-toting robot dogs, but makers insist they're really dumb

In brief Whether or not non-fungible tokens are a flash in the pan or forever, malware operators have been keen to weaponise the technology.

An investigation was triggered after a number of cryptowallets belonging to customers of the largest NFT exchange OpenSea got mysteriously emptied. Researchers at security shop Check Point found a nasty form of NFT was in circulation, one that came with its own malware package.

People were receiving free NFTs from an unknown benefactor, but when they accepted the gift the attackers got access to their wallet information in OpenSea's storage systems. The code generated a pop-up, that if clicked, allowed wallets to be emptied.

Continue reading

Bank manager tricked into handing $35m to scammers using fake 'deep voice' tech

Plus: Microsoft Translator machine learning software now supports over 100 languages

In brief Authorities in the United Arab Emirates have requested the US Department of Justice's help in probing a case involving a bank manager who was swindled into transferring $35m to criminals by someone using a fake AI-generated voice.

The employee received a call to move the company-owned funds by someone purporting to be a director from the business. He also previously saw emails that showed the company was planning to use the money for an acquisition, and had hired a lawyer to coordinate the process. When the sham director instructed him to transfer the money, he did so thinking it was a legitimate request.

But it was all a scam, according to US court documents reported by Forbes. The criminals used "deep voice technology to simulate the voice of the director," it said. Now officials from the UAE have asked the DoJ to hand over details of two US bank accounts, where over $400,000 from the stolen money were deposited.

Continue reading

Amazon textbook rental service scammed for $1.5m

Michigan man arrested for borrowing costly textbooks and selling them

A 36-year-old man from Portage, Michigan, was arrested on Thursday for allegedly renting thousands of textbooks from Amazon and selling them rather than returning them.

Andrew Birge, US Attorney for the Western District of Michigan, said Geoffrey Mark Hays Talsma has been indicted on charges of mail and wire fraud, transporting stolen property across state lines, aggravated identity theft, and lying to the FBI.

Also indicted were three alleged co-conspirators: Gregory Mark Gleesing, 43, and Lovedeep Singh Dhanoa, 25, both from Portage, Michigan, and Paul Steven Larson, 32, from Kalamazoo, Michigan

Continue reading

Computer scientists at University of Edinburgh contemplate courses without 'Alice' and 'Bob'

Academics advised to consider excluding certain terminology for the sake of inclusivity

A working group in the School of Informatics at the University of Edinburgh in Scotland has proposed a series of steps to "decolonize" the Informatics curriculum, which includes trying "to avoid using predominantly Western names such as Alice/Bob (as is common in the computer security literature)."

The names Alice and Bob were used to represent two users of a public key cryptography system, described in a 1978 paper by Ronald Rivest, Adi Shamir, and Leonard Adleman, "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems." And since then, a variety of other mostly Western names like Eve – playing an eavesdropper intercepting communications – have been employed to illustrate computer security scenarios in related academic papers.

The School of Informatics' working group reflects the University of Edinburgh's commitment to diversity, equity, and inclusion and to meet specific obligations spelled out in Scottish regulations like the Equality Act 2010 and the Public Sector Equalities Duty.

Continue reading

Toyota needs more than its Cheer Squad to deal with chip shortages, as five more home factories forced into idleness

Car makers facing increasingly tough times until supply catches up

Toyota said it would cut car production by up to 150,000 vehicles due to ongoing semiconductor shortages and restrictions associated with the COVID-19 pandemic.

The car maker is idling five factories in home country Japan on some days in November, which affects the production of popular models including Corolla and Camry.

Toyota started cutting production in August due to chip shortages and said, "we expect the shortage of semiconductors to continue in the long-term".

Continue reading

Missouri governor demands prosecution of reporter for 'decoding HTML source code' and reporting a data breach

Salus populi suprema lex esto ... or perhaps not

A Missouri politician has been relentlessly mocked on Twitter after demanding the prosecution of a journalist who found and responsibly reported a vulnerability in a state website.

Mike Parson, governor of Missouri, described reporters for local newspaper the St Louis Post Dispatch (SLPD) as "hackers" after they discovered a web app for the state's Department of Elementary and Secondary Education was leaking teachers' private information.

Around 100,000 social security numbers were able to be exposed when the web app was loaded in a user's browser. The public-facing app was intended to be used by local schools to check teachers' professional registration status. So users could tell between different teachers of the same name, it would accept the last four digits of a teacher's social security number as a valid search string.

Continue reading

Everyone who wants a smartphone for Chrimbo will get one, but in the real world things are somewhat different

Global handset market slips in Q3 on sliding chipset availability, says Canalys

Crippling component shortages caused smartphone shipments to dip in calendar Q3, though it was the also-rans, vendors outside of the top five biggest brands with the lowest economies of scale, that suffered most.

Preliminary results from Canalys show the market declined 6 per cent year-on-year. The analyst was not yet ready to make public the absolute shipment figures but a year ago sales into the channel were 348 million, so they look 20.9 million units lighter.

"The chipset famine has truly arrived," said Ben Stanton, principal analyst. "On the supply side, chipset manufacturers are increasing prices to disincentivize over-ordering, in an attempt to close the gap between supply and demand. But despite this, shortages will last until well into 2022."

Continue reading

Windows terminates here. Please remember to finish setting it up on arrival

Washington Metro admin has taken an early lunch

Bork!Bork!Bork! It's a whole new world for bork today as a Washington Metro platform indicator suggests an alternative to the usual train for weary commuters. How about getting a bit more out of Windows?

This is a suggestion that everyone wants to see while waiting for a Yellow Line train at Washington Metro's Huntington Station (located, helpfully, on Huntington Avenue in the Huntington Area).

Continue reading

Boeing 737 Max chief technical pilot charged with deceiving US aviation regulators over MCAS

He hasn't got $2.5bn to hand to the DoJ, unlike his bosses

A Boeing 737 Max test pilot has been charged with obstructing US aviation safety regulators, according to the US Department of Justice, and faces up to 20 years in prison if convicted.

Former 737 Max chief technical pilot Mark Forkner, 49, of Texas, has been charged with "deceiving the Federal Aviation Administration's Aircraft Evaluation Group" (AEG) and committing fraud by misleading Boeing's airline customers into believing the 737 Max was a safe aircraft.

"Forkner allegedly abused his position of trust by intentionally withholding critical information about MCAS during the FAA evaluation and certification of the 737 MAX and from Boeing's US-based airline customers," said Assistant Attorney General Kenneth A Polite Jr of the Justice Department's Criminal Division in a statement.

Continue reading

Keep expectations low and you won't be disappointed: OVH manages 6 per cent increase on its IPO debut

French cloud provider puts outage and fire behind it to focus on beating the big players

French cloud and colocation service provider OVH has edged a 6 per cent increase in its nominal market valuation following its initial public offering on the Euronext Paris stock exchange.

The Gallic tech challenger, viewed by some as the great cloud hope for Europe, has faced its fair share of challenges this year, having seen fire engulf its Strasbourg operations on 10 March.

But the European IPO proved hot in other ways, with shares up to around €19.70, well on track with the launch price range of €18.50-€20.

Continue reading

Space boffins: Exoplanet survived hydrogen-death of its host star

Hope extended to gas giants across the universe... well, it is Friday

Those of us fatalistically counting down the minutes until the Earth is engulfed by the dying embers of the Sun in approximately 5 billion years might be offered a glimmer of hope by the news that planets – or at least gas giants – can survive the collapse of their host star.

Joshua Blackman, a postdoctoral researcher at Australia's University of Tasmania, and his colleagues have found evidence of a Jupiter-like planet orbiting a white dwarf star somewhere outside the Solar System off in the Milky Way.

It is the first time scientific evidence of a planet surviving a star's collapse has been presented, although theoretical models predicted it is possible, according to a study published in Nature.

Continue reading