Connect with us

Biz & IT

The fractured future of browser privacy



In the 1990s, web browsers like Netscape Navigator and Microsoft Internet Explorer competed bitterly to offer the snazziest new features and attract users. Today, the browser landscape looks totally different. For one thing, Chrome now dominates, controlling around two-thirds of the market on both desktop and mobile. Even more radical, though, is the recent competitive focus on privacy, a welcome change for anyone who’s gotten sick of creepy ad tracking and data mismanagement. But as browsers increasingly diverge in their approaches, it’s clear that not all privacy protections are created equal.

At the USENIX Enigma security conference in San Francisco this week, developers, security researchers, and privacy advocates presented differing views of how browsers should protect their users against data abuses. In a panel discussion that included representatives from Mozilla Firefox, Google Chrome, Microsoft Edge, and Brave, all participants agreed that collaboration across the industry has driven innovation and helped make privacy a priority. But some browsers are taking a hardline approach, while others prefer to increase protections within the status quo.

“I think competition pushes everyone toward being more private by default,” Yan Zhu, chief information security officer of the Brave browser, said during the panel. “For instance, when Brave sees Safari rolling out a new protection we think ‘Oh, we should at least try to match that,’ because as a privacy-first, privacy-focused browser that is one of our main selling points.”

Browsers can take a number of steps to thwart the tracking efforts of websites and ad networks. They can add anti-fingerprinting measures, which make it harder for sites and services to connect your browsing to you based on unique characteristics—a “fingerprint”—of your browser and device. They can block trackers embedded in sites. They can take extra steps to encrypt information about what websites you visit. And they can support third-party extensions that allow users to further adapt and customize their privacy protections.

Another longstanding topic of debate is how to handle third-party website “cookies” that browsers store to customize your web experience, but that sites often also use for tracking. Safari, Firefox, and Brave have all decided to block third-party cookies by default—much to advertisers’ chagrin. Google announced earlier this month that it will eventually take this step as well, though not for two years. As a major ad distributor itself, Google also stands to benefit from blocking third-party trackers that other browsers don’t.

Almost all mainstream browsers take these privacy-friendly steps in some form, but under different conceptual approaches. A lot of the debate hinges on the question of how far to push screening and blocking, given that these protections can sometimes create collateral damage. Privacy defenses can sometimes break legitimate website functionality; comments that load from a third-party hosting service, for example, could be mistaken for a sketchy targeted ad module. So each browser has to weigh how it prioritizes privacy versus ease of use.

“Firefox, Edge, Brave, and Safari all have anti-tracking protections by default, and they all vary a little bit, they all have different tradeoffs,” Tanvi Vyas, Mozilla’s principal engineer, said during the panel. “But in the end we’re all trying to improve those protections and we’re learning from each other on how to do that. I think we [Firefox] differ from Chrome in that we’re not trying to preserve the existing model. For us our highest priority is privacy, so when we choose between the existing model and privacy we’ll always choose privacy.”

Broadly speaking, advertisers don’t actually need your data. All that they really want is to monetize efficiently

That existing model allows companies and advertisers at least some access to marketing data; one argument for preserving it is that if browsers become too restrictive, those parties will pull content from the open web and move it to mobile apps instead.

“The web doesn’t exist in a vacuum. People who are building sites and services have choices about the platforms they target,” says Eric Lawrence, an Edge program manager. “They can build a mobile application, they can take their content off the open web to put it into a walled garden. And so if we do things in privacy that hurt the open web, we could end up pushing people to less privacy-preserving ecosystems.”

Justin Schuh, Chrome’s director of engineering, says Google is already seeing this migration toward apps and other closed platforms. He argues that while there’s nothing wrong with this evolution in theory, it shouldn’t come at the web’s expense. So Chrome has been working on a set of open standards, collectively known as the Privacy Sandbox, that aims to find a middle ground on privacy protections to keep advertisers in the fold.

“Broadly speaking, advertisers don’t actually need your data. All that they really want is to monetize efficiently,” Schuh said during the Enigma panel. “So what we’re proposing here is we can just give them the tools to do that without actually building user profiles and tracking them.” With the Privacy Sandbox, Google plans to propose standards that would anonymously aggregate ad data for marketers and put more of the processing of ad targeting on users’ own devices.

Chrome has been adamant that this proposal is about strengthening the open web; if content moves to closed-off apps, users won’t benefit from the transparency and protections technologists have worked so hard to develop and standardize for everyone online. But it’s hard to ignore that Google, which runs one of the largest online ad networks in the world, also has a clear economic interest in safeguarding that industry.

Critics of that approach argue that adding a layer of privacy to the status quo doesn’t resolve the fundamental issues that make digital marketing so invasive. It’s a hard enough problem to solve even with the best intentions, as efforts to reduce tracking and fingerprinting can actually have the opposite effect. For example, Apple has been working to solve issues with Safari’s Intelligent Tracking Prevention that could allow someone to use the feature’s blocking patterns themselves to identify and track users. Researchers continue to find flaws in the company’s fixes.

“The public attention on how we are tracked every day, and the efforts in several regions of the world, seem to have put more pressure on browsers to do right by their users and make privacy the default,” says Andrés Arrieta, director of consumer privacy engineering at the Electronic Frontier Foundation, who also presented browser privacy research at USENIX Enigma. “But they don’t do it the same way and it doesn’t have the same effect. Some tout themselves as doing much for their users, but in reality aren’t, and in some cases are doing even worse, like standardizing other ways of tracking users, removing user control, and making tracking the default.”

Disagreements over the best approach to web privacy issues have gotten so heated that some players have opted to keep a low profile. Microsoft Edge, for example, is looking to shed the baggage of poor choices Internet Explorer made in the early 2000s, and rebrand as a trustworthy but neutral option.

“One of the things that thus far we’ve tried to do in Edge is be a little more quiet about it,” Edge’s Lawrence says. “We don’t really show off the privacy features at the top level, there’s not a lot of communicators saying, ‘Hey, we’re protecting you in this way or that way.'”

Edge is now built on Google’s open source Chromium software, but it still uses Microsoft-developed features in place of anything that would involve Google as a third party. This way Edge users don’t have to trust a second ubiquitous tech giant and risk more ad networks feasting on their data just to use Microsoft’s browser. For example, Edge uses a feature called Microsoft Defender SmartScreen in place of Google’s Safe Browsing. Edge also offers a feature called Tracking Prevention, Microsoft’s take on a tracker blocker that users can adjust to be more or less strict depending on their tolerance for false positives.

The showdown is clearly just beginning over the best path for browsers to take. But it’s refreshing, at least, for these platforms to finally be debating user protections and competing to offer the strongest defenses. The question is still whether they can get it right.

This story originally appeared on

Continue Reading

Biz & IT

Ukraine arrests ransomware gang in global cybercriminal crackdown



Enlarge / A Colonial Pipeline facility in Woodbridge, New Jersey. Hackers last month disrupted the pipeline supplying petroleum to much of the East Coast.

Ukrainian police have arrested members of a notorious ransomware gang that recently targeted American universities, as pressure mounts on global law enforcement to crack down on cybercriminals.

The Ukraine National Police said in a statement on Wednesday that it had worked with Interpol and the US and South Korean authorities to charge six members of the Ukraine-based Cl0p hacker group, which it claimed had inflicted a half-billion dollars in damages on victims based in the US and South Korea.

The move marks the first time that a national law enforcement agency has carried out mass arrests of a ransomware gang, adding to pressure on other countries to follow suit. Russia, a hub for ransomware gangs, has been blamed for harbouring cybercriminals by failing to prosecute or extradite them.

Cl0P is one of several ransomware cartels that seize a target’s data, demanding a ransom to release it. The group has also increasingly threatened to leak sensitive information online if a target refuses to pay, a tactic known as “double extortion.”

Recent targets have included oil company Shell and international law firm Jones Day, as well as several US universities including Stanford and the University of California. In most cases, the hackers wielded a vulnerability in a file transfer product run by Accellion to compromise their victims.

The arrests come as ransomware has been thrust into the spotlight in recent weeks, following a number of audacious attacks hitting critical infrastructure. Last month, hackers disrupted the Colonial Pipeline supplying petroleum to much of the US East Coast—an attack the White House has attributed to a Russian-based group.

As a result, governments are under increasing pressure to curb the activities of cybercriminals. This week, US President Joe Biden attended a summit in Geneva with Russia’s President Vladimir Putin, in which both parties were expected to discuss the threat of ransomware.

Some experts allege Moscow allows ransomware criminals to operate with impunity in the country on the understanding that hackers will not target Russian-speaking organizations and will share access with the government if called upon to do so. Ahead of the summit, however, both Putin and Biden suggested they were open to exchanging cybercriminals.

As part of its Cl0P takedown, the Ukrainian police on Wednesday said that it had conducted 21 searches in the Kyiv region of homes and cars of those arrested, seizing computer equipment, 5 million Ukrainian hryvnias (around $185,000), and property. Video footage shared by the police showed officers raiding homes in what appeared to be wealthy neighborhoods, and towing luxury cars including Teslas.

The police also said it had “managed to shut down” some of the group’s digital infrastructure.

It is unclear whether those arrested were core members of the group or affiliates. The defendants face eight years in prison, the statement said.

© 2021 The Financial Times Ltd. All rights reserved. Not to be redistributed, copied, or modified in any way.

Continue Reading

Biz & IT

Newly discovered Vigilante malware outs software pirates and blocks them



A researcher has uncovered one of the more unusual finds in the annals of malware: boobytrapped files available on sites frequented by software pirates that rat out downloaders and try to prevent unauthorized downloading in the future.

Vigilante, as SophosLabs Principal Researcher Andrew Brandt is calling the malware, gets installed when victims download and execute what they think is pirated software or games. Behind the scenes, the malware reports the file name that was executed to an attacker-controlled server along with the IP address of the victims’ computers. As a finishing touch, Vigilante tries to modify the victims’ computers so they can no longer access and as many as 1,000 other pirate sites.

Not your typical malware

“It’s really unusual to see something like this, because there’s normally just one motive behind most malware: stealing stuff,” Brandt wrote on Twitter. “Whether that’s passwords, or keystrokes, or cookies, or intellectual property, or access, or even CPU cycles to mine cryptocurrency, theft is the motive. But not in this case. These samples really only did a few things, none of which fit the typical motive for malware criminals.”

Once victims have executed the trojanized file, the file name and IP address are sent in the form of an HTTP GET request to the attacker-controlled 1flchier[.]com, which can easily be confused with the cloud-storage provider 1fichier (spelled with an L as the third character in the name instead of an I). The malware in the files is largely identical except for the file names it generates in the web requests.

Vigilante goes on to update a file on the infected computer that prevents it from connecting to The Pirate Bay and other Internet destinations known to be used by people trading pirated software. Specifically, the malware updates Hosts.txt, a file that pairs one or more domain addresses to distinct IP addresses. As the image below shows, the malware pairs to, a special-purpose IP address, often called the localhost or loopback address, that computers use to identify their real IP address to other systems.


By mapping the domains to the local host, the malware ensures that the computer can no longer access the sites. The only way to reverse the blocking is to edit the Hosts file to remove the entries.

Brandt found some of the trojans lurking in software packages available on a Discord-hosted chat service. He found others masquerading as popular games, productivity tools and security products available through BitTorrent.

There are other oddities. Many of the trojanized executables are digitally signed using a fake code signing tool. The signatures contain a string of randomly generated 18-character uppercase and lowercase letters. The certificate validity began on the day the files became available and is set to expire in 2039. Additionally, the properties sheets of the executables don’t align with the file name.

Executables, when viewed through a hex editor, also contain a racial epithet that’s repeated more than 1,000 times followed by a large, randomly sized block of alphabetical characters.

“Padding out the archive with purposeless files of random length may simply be done to modify the archive’s hash value,” Brandt wrote. “Padding it out with racist slurs told me all I needed to know about its creator.”

Vigilante has no persistence method, meaning it has no way to remain installed. That means people who have been infected need only edit their Hosts file to be disinfected. SophosLabs provides indicators of compromise here.

Continue Reading

Biz & IT

Starlink dishes go into “thermal shutdown” once they hit 122° Fahrenheit



Enlarge / Starlink satellite dish and equipment in the Idaho panhandle’s Coeur d’Alene National Forest.

A Starlink beta user in Arizona said he lost Internet service for over seven hours yesterday when the satellite dish overheated, demonstrating one of the drawbacks of SpaceX’s broadband service. When the user’s Internet service was disrupted, the Starlink app provided an error message saying, “Offline: Thermal shutdown.” The dish “overheated” and “Starlink will reconnect after cooling down,” the error message said.

The user, named Martin, posted a screenshot of the error message on Reddit. He contacted Starlink support, which told him, “Dishy will go into thermal shutdown at 122F and will restart when it reaches 104F.” Martin decided to give the dish a little water so it could cool down. He pointed a sprinkler at Dishy, and once it cooled enough to turn back on, “I immediately heard YouTube resume playback,” he wrote yesterday.

But the Internet restoration was short-lived, Martin told Ars in a chat today.

“The fix was temporary,” he told us. “When I stopped the sprinkler, [the dish] heated back up and would cycle back on for a few minutes and go back down for thermal shutdown. The overheating started that day about 11:30 am and came back for good about 7 pm… I’m currently headed to a hardware store to get materials to build a solar shade/sail around the dish to see if it doesn’t impact connection and speed.”

Martin uses the ground behind his house to set up his dish because it is the only spot with no obstructions. But there’s “no shade to speak of,” he wrote in the Reddit comment thread.

Thermal shutdowns affect other users

Officially, SpaceX has said that “Dishy McFlatface” is certified to operate from 22° below zero up to 104° Fahrenheit. Temperatures reached about 120° yesterday in Martin’s town of Topock, near Arizona’s border with California, he said. Though Dishy doesn’t go into thermal shutdown until it hits 122°, the dish can obviously get hotter than the air temperature.

“I’m thinking the radiating heat from the ground is effectively cooking the bottom of the dish, [while] the top of the dish is cooked by the sun,” Martin told Ars. In addition to the shade he’s building, Martin said he is “waiting for permitting for a HAM radio tower” that would lift the dish off the ground to help keep it cool enough to operate.

Martin said he also had very short outages on several days since last week, but service came back before he had time to confirm whether they were caused by heat. SpaceX told users to expect periodic outages during beta, so Martin’s previous outages could have been due either to heat or satellite availability.

Another user in Virginia experienced a half-hour outage due to overheating on a day with temperatures in the low 80s, according to a Reddit post two months ago.

Martin’s post spurred a response from a beta user who also reported thermal shutdowns. “You’re not the only one. My Starlink is located 50 miles south of Grand Canyon in remote area,” one person wrote yesterday. “It’s been off and on also. It stopped today one hour after cool down period but quit again as [of] ~12:30. Last reported temp at my weather station was 103 degrees.”

The 122° F shutdown temperature was mentioned three weeks ago in a Reddit post by a user who had also been given the figure by Starlink support. “‘That’s it??’ was my thought. On a 90 degree day, the rooftop of my house can be around 125 degrees,” that user wrote.

“Are you sure that wasn’t Celsius?” another asked. (122° C converts to 251.6° F.)

Like Martin, other Starlink users may have to find creative ways to keep their dishes cool as the summer months arrive.

Dishy’s heat management

As we wrote in December, a teardown of Dishy McFlatface showed some of its heat-management components, including a metal shield that’s peppered with blue dots made of thermally conductive material that conducts heat away from the PCB and into the shield.

Ken Keiter, the engineer who performed the teardown, was interviewed by Vice’s Motherboard section for a story about the Arizona resident today:

Keiter told Motherboard that while reasonable consideration was given to heat dissipation in Dishy’s design, he could see the potential for problems.

“The phased array assembly comprises a PCBA (printed circuit board assembly) adhered to an aluminum backplate which serves several purposes—acting as RF shielding, providing structural rigidity and, most relevantly, acting as a radiative thermal mass (heat sink) for the components on the PCBA,” Keiter said.

Heat is funneled from the circuit board to the aluminum backplate using a foam-like thermal interface material (TIM). The backplate itself resides in a weather-sealed cavity containing a small amount of air. As this backplate heats up, the air surrounding it also heats, transferring thermal energy via the plastic enclosure to the outside environment, Keiter said.

“Here’s the problem: at some point, the combined thermal energy being absorbed by Dishy’s face and being dumped by the components into the backplate, the air surrounding it, and the enclosure exceeds the amount that is being dissipated to the outside environment,” he noted.

Keiter said that software changes could “make the system more thermally efficient” but that it’s possible SpaceX will need to make “a significant hardware revision for the commercial launch.” He called it “a really tricky engineering problem with some insanely tight constraints.”

We contacted SpaceX today and will update this article if we get a response.

SpaceX seeks stability before exiting beta

The Starlink public beta began in October 2020, and there’s still no word on when exactly it will hit commercial availability. But the service could happen within months, as SpaceX CEO Elon Musk has said that Starlink will be available to “most of Earth” by the end of 2021 and the whole planet by next year. Still, SpaceX expects to have a limited number of slots in each geographic region because of capacity constraints.

SpaceX is seeking Federal Communications Commission permission to deploy up to 5 million user terminals in the US. Over 500,000 people have ordered Starlink, and Musk has said he expects all of those users to get service. But he also said that SpaceX will face “more of a challenge when we get into the several million user range.” The biggest limitation would be in densely populated urban areas; rural users would have better odds of getting service.

As noted earlier, Starlink warns beta users to expect “brief periods of no connectivity at all”—even if they don’t run into thermal shutdowns. “We still have a lot of work to do to make the network reliable,” SpaceX president and COO Gwynne Shotwell said in April. “We still have drops, not necessarily just because of where the satellites are in the sky.” SpaceX will keep the service in beta “until the network is reliable and great and something we’d be proud of,” Shotwell said.

The Verge reviewed Starlink last month and found frustrating reliability problems. “Like the similarly over-hyped mmWave 5G, Starlink is remarkably delicate. Even a single tree blocking the dish’s line of sight to the horizon will degrade and interrupt your Starlink signal,” The Verge wrote.

Starlink is only part of the solution

The service will surely become more stable by the time SpaceX moves it from beta to general availability, as Shotwell promised. Even in beta, Starlink is providing much-needed connectivity to people with no other options. If SpaceX brings reliable broadband to a few million users, that would be a success, but there may be tens of millions of Americans without access to high-speed broadband. Tens of millions of others have to pay whatever the cable company demands because there’s no competition where they live.

Widespread fiber-to-the-home deployment would make a bigger difference for more Internet users than Starlink. President Joe Biden pledged to lower prices and deploy “future-proof” broadband to all Americans, but he’s already scaled back his plan in the face of opposition from Republicans and incumbent ISPs. AT&T has been lobbying against nationwide fiber and funding for municipal networks, and AT&T CEO John Stankey expressed confidence last week that Congress will steer legislation in the direction that AT&T favors.

Continue Reading