A small startup that has been around for less than a year has created a free mobile app aimed at helping Americans and people all over the world resist the police state.  The app, called Cell 411 (or Cell 112 in Europe), is available in English, Spanish, Portuguese, German and Romanian, and it helps activists and people from all political shades resist government abuse with decentralized GPS-based alerts and live video features. Whether you are a gun-rights activist, an anti-Trump protester, concerned with police brutality or simply a muslim woman concerned for her safety, this app can help you build decentralized groups, or “cells” of trusted connections which you can then use to dispatch when you need help.

Because this app has been so revolutionary in its approach to building a new way to handle emergencies and the police state, it has been selected by the Victoria & Albert Museum in London to be featured in the “Future of Design” exhibit in 2018.

Think of this app as an “UBER for emergencies” or a “911 on steroids” except it doesn’t involve government, police or people  you don’t trust.  The app was created by a small group of passionate engineers, activists and people concerned with the growth of police state all over the world.  It can be used by anyone with an Android or iOS smartphone and it has tens of thousands of users all over the world.

Here is how it works: users can freely download the app and signup for an account using their e-mail address of Facebook account. Once signed up, a user can join existing public “cells” or groups in their areas, or can create their own cells.  Joining a cell allows you to send and receive emergency alerts from the members of that cell.  Let’s say you want to create a cell in your town called, “Denver Mutual Aid.”  Al users in the Denver area will be notified when this cell was created and can join the cell in order to offer each other help when the members request the help.  There are thousands of cells all over the world used by users for many reasons, such as immigration help, neighborhood watching, etc.

You can also create private cells which are only visible to you an not other users, and you can add your friends to your private cells.

The app allows you to send emergency alerts about medical problems, police abuse, vehicle problems, crime, and other issues; the alerts are tagged with your exact GPS coordinates and your friends can get turn-by-turn directions to your location, should they decide to come and offer you help.  You can stream live video to your cells and friends, and the video cannot be erased by a malicious user who may gain access to your phone.  The video can also be streamed to YouTube and Facebook and is distributed instantly to all your friends, making it nearly impossible to be destroyed.

The app was specifically designed to be resistant to censorship and government surveillance and has been used successfully all over the world to save lives and keep users safe from criminals, police abuse and many other malicious actors.

The company also created a “panic button” which is a bluetooth device that pairs with the mobile app and allows users to issue alerts instantly without having to unlock the phone or spend precious time navigating an app. Recently a “ride sharing” feature was also added to the app to allow users to offer rides to each other when they need help and accept payments for cash, Bitcoin, silver and even bartering.

You can download Cell 411 for Android and Apple devices from http://getcell411.com/download

You can also watch a quick walk-trough of the main features of this app below:

L’application que les flics ne veulent pas que vous ayez

Un utilisateur la décrit comme « un outil révolutionnaire qui va changer notre société ». Un autre dit qu’elle est « badass » et Bary Cooper de NeverGetBusted.com qui est un ancien détective de police décoré en dit que c’est « le nouveau 911 mais en plus sûr ». Les autres utilisateurs la décrivent comme « tout droit sortie d’une fiction cyberpunk » et un autre dit « Je veux vraiment utiliser cette application avant d’appeler un policier ! » Les distinctions se font légion et la police la déteste :

« C’est ce que j’attendais depuis longtemps »

« C’est une très bonne application pour les personnes qui vivent dans des zones où les citoyens et la police ne s’entendent pas »

« C’est comme UBER pour le 911 ! »

« Bientôt, 911 appartiendra au passé… »

Cette nouvelle application mobile a pris d’assaut le monde d’activisme et les polices la détestent. Elle s’appelle Cell411 et c’est une application qui a été créé par des activistes pour des activistes, mais aussi pour n’importe qui qui se trouve en situation d’urgence et qui voudrait appeler un groupe d’amis à qui il fait confiance plutôt que la police.

L’application, qui est disponible sur les plateformes Android et IOS, permet aux utilisateurs d’émettre diverses alertes à des groupes de membre de la famille, du voisinage et d’amis en qui ils ont confiance. La question de faire face aux urgences, sans intervention de la police est venu à l’avant-garde du débat sur la brutalité policière car de nombreux cas ont montré que la police répond aux situations d’urgence avec la brutalité et tirent sur des chiens, tuent des personnes suicidaires et souvent n’aident pas ceux qui demandent de l’aide, mais les blesse et les tuent.

L’application sur smartphone vous autorisera à créer des groupes privés ou publics dans votre zone géographique et de les utiliser comme une méthode pour demander de l’aide en cas d’urgence. Vous pouvez avertir vos amis quand vous avez un pneu à plat, vous faites tirez dessus, avez un problème médical ou lorsque les policiers vous harcèlent. Vous pouvez aussi enregistrer des vidéos en direct pour vos amis et éviter la possibilité que la vidéo soit détectée par la police ou que l’évidence ne soit détruite par un individu malveillant.

Une fois que vous avez demandé de l’aide, vos amis recevront votre coordonnées GPS et les directions vers votre emplacement exacte ; vous serez avertis d’un ETA et où sont vos amis.

Il y a même un « mode patrouille » disponible qui peut même vous permettre d’envoyer ce que l’on appelle des « alertes globales » ce qui signifie que n’importe qui utilisant l’application dans votre zone recevra des notifications et sera capable de venir et de vous aider, et même se sentir comme un bon samaritain.

La meilleure chose à propos de cette application c’est qu’elle est complètement gratuite, et que l’option de permettre aux utilisateurs de créer des « groupes publics » que tout le monde peut rejoindre est très puissante et offre aux communautés l’option de faire elle aussi la police. Voici quelques exemples des fantastiques possibilités que cette application offre :

Par exemple, un groupe de surveillance de quartier de voisins pourrait créer un groupe et utiliser l’application pour avertir tous les autres en cas d’urgences.

• Les personnes âgées peuvent utiliser l’application pour avertir tous les membres de famille s’ils ont un besoin particulier.
• Les activistes qui observent l’activité de la police ou les abus de la police peuvent avertir tous les activistes dans une zone et streamer la vidéo à tous leurs amis.
• Les pompiers volontiers peuvent encourager leurs communautés à utiliser l’application comme une option « d’expédition » gratuite.
• Les écoliers peuvent envoyer des alertes s’ils sont harcelés ou victimes d’abus à l’école.
• Les membres de la famille peuvent être alertés quand les véhicules tombent en panne et ont besoin d’une urgence rapide.

Il y a d’innombrables autres possibilités pour cette application, et les créateurs visent clairement l’application des utilisateurs qui désirent être autonomes et ne pas dépendre des services gouvernementaux et des employés du gouvernement pour répondre aux urgences.

Vous pouvez télécharger Cell 411 sur http://getcell411.com.

La courte vidéo ci-dessous explique les caractéristiques basiques de l’application.

A Miami woman shot and killed a teenage home intruder last week, authorities said. Now, relatives of the teen are saying she acted unjustly and should be prosecuted.

Trevon Johnson, 17, burglarized the home of a 54-year-old old woman last Thursday, according to Miami-Dade police.

The woman told police that she was not home when the break-in occurred, but her surveillance system alerted her that there was an intruder. She said she rushed home and found the teen climbing out of a window.

“She observed a subject leaving the home through the rear,” police Detective Dan Ferrin told WFOR-TV.

A confrontation then took place, according to police, and shots were fired. Police said they were on scene seconds after the shooting and performed CPR on the teen. Johnson was then rushed to the hospital where doctors pronounced him dead.

“What’s wrong with her?” Johnson’s sister Nisha Johnson asked. “She did not have to shoot him.”

Johnson told WFOR her brother was a student at D. A. Dorsey Technical College. She and other relatives are outraged by the shooting.

“I don’t care if she have her gun license or any of that. That is way beyond the law … way beyond,” Johnson’s cousin Nautika Harris told WFOR. “He was not supposed to die like this. He had a future ahead of him. Trevon had goals … he was a funny guy, very big on education, loved learning.”

“You have to look at it from every child’s point of view that was raised in the hood,” Harris continued. “You have to understand … how he gonna get his money to have clothes to go to school? You have to look at it from his point of view.”

Thus far, police appear to be siding with the homeowner who they say was protecting her property.

“She’s a person that is a little distraught because this is her home that someone obviously was in,” Ferrin said.

Police said the woman was taken to a police station for questioning and has cooperated with detectives.

Investigators told WFOR that they are still investigating the incident, but in the meantime, they want the public to remember that, if possible, it is best not to take these types of situations into one’s own hands.

“If there’s any type of situation that happens or they believe there’s a burglary at the home or any type of confrontation, dial 911. Have the police make that confrontation,” Ferrin said. “That’s what we’re here for.”

The case has been handed over to state attorney’s office, but so far, no charges have been filed against the homeowner.

“It’s no reason she should have waited until I think he walked out the yard to try to shoot him,” Harris said. “If she called the police already, why would she shoot him?”

Relatives told WFOR they don’t believe Johnson stole anything from the woman’s home, but detectives would not confirm that.

by Virgil Vaduva

Last week I covered the story of the FBI asking a federal judge to order Apple to insert a back-door into iOS in order to gain the ability to brute force the password and encryption keys of the San Bernardino shooter, and I concluded that Apple rightly said ‘No’ to the demand, pointing out how this would establish an extremely dangerous technical and legal precedent.

It turns out that I was right, and so was Apple’s CEO, when stating that undermining the security of iOS would destroy confidence in the security of their products and give the FBI the ability to undermine the privacy of any iPhone user at the FBI’s discretion. In essence, Apple is literally fighting for its life as doing so would cause customers to abandon Apple products in droves.

Now it turns out that the Justice Department now has filed additional motions asking courts to force Apple to undermine the security of 12 more iPhones related to unknown legal cases throughout the country. The undisclosed cases are not related to terrorism, which means that the FBI director outright lied when he stated that the case of the San Bernardino shooter was the one and only case in which Apple would be required to insert a “backdoor” into their operating system.

Apple no longer stores encryption keys for user devices and keys are now derived based on the passwords or passphrases users choose when they lock their devices. This means that it is technically impossible for Apple to “decrypt” an iOS device, however the FBI has asked Apple to build a custom iOS release which disabled the auto-wipe feature and the waiting period required between failed password, which in essence would allow the FBI to mount brute-force attacks against an encrypted device and eventually guess the password and decrypt the device.

In addition to the court order in the San Bernardino case, Apple also revealed that they in fact provided the FBI with decrypted, weekly backups of the shooters phone, however the FBI demanded the latest backup, which they were unable to obtain after one of their own agents reset the suspect’s password making the backup unusable. After screwing up the forensic recovery, the FBI resorted to attempting to force Apple to provide technical assistance beyond any reasonable expectations.

These latest revelations clearly indicate that the FBI director Brien Comey outright lied when stating that Apple will be required to decrypt only one device, and while Apple has not made a public comment about these additional cases, the court filing indicate that they objected to all of them or are about to do so.

Apple has until Friday, February 26 to file its first legal arguments in a California court.

Virgil Vaduva is a Libertarian security professional, journalist, photographer and overall liberty freak. He spent most of his life in Communist Romania and participated in the 1989 street protests which led to the collapse of the Ceausescu regime. He can be reached at vvaduva at truthvoice.com.

By Virgil Vaduva

Bitcoin and technology media is in a feeding frenzy over the revelations from Wired Magazine and Gizmodo about the latest news: Satoshi Nakamoto has been identified! And his name is Craig Steven Wright, an Australian man living in a modest Sidney home, who has a lot of “big computer equipment” in his basement, needing a lot of electricity.

In what appears to be an elaborate hoax played on the media, an unknown individual (or a group of individuals ), likely Craig Wright himself, managed to disseminate just enough circumstantial evidence in order to motivate an eager journalist to determine that he, namely Craig Wright, is Satoshi Nakamoto, the original creator of Bitcoin.

Virtually all of Wired Magazine’s original article is in essence concluding that Wright is Satoshi based on blog post time stamps dating as far back as 2008, supposed leaked e-mail messages and transcripts of conversations between Wright and New South Wales government employees. The Gizmodo article also attempts to use the same evidence to reach similar conclusions. The irony in all these explosive revelations is that all authors involved in the writing of the Wired and Gizmodo articles are going out of their way to not repeat the mistakes of the Newsweek 2014 article which erroneously outed an innocent bystander named Dorian Nakamoto as the creator of Bitcoin. They are using words like “probably” and even include an unambiguous disclaimer in the piece, stating,

Despite that overwhelming collection of clues, none of it fully proves that Wright is Nakamoto.

In October 2014, Dorian Nakamoto announced that he intended to sue Newsweek, and months after taking relentless mocking and heat from the general public, Newsweek appears to have moved the original piece on Nakamoto behind a paywall that ignores the “5 Free Articles” limit extended to non-subscribers. Having learned from Newsweek’s mistakes, perhaps Wired and Gizmodo are simply trying to have it both ways: create a massive amount of publicity and traffic, and be able to walk away from a highly controversial story saying that they never claimed with certainty that Wright is Satoshi .

Here is why I believe that Craig Wright is not Satoshi Nakamoto:

1. Time stamps on blog posts can be easily faked. A blog post’s date and time can easily be written today and made to look as if it was written in 2008.
2. Any documents claimed to be “leaked” coming from anonymous sources can also be faked and manipulated. This includes audio recordings, transcripts and supposed e-mail messages.
3. Wired’s claim that e-mail addresses used by Craig Wright are “very similar” to e-mail addresses used by Satoshi Nakamoto is just journalistic hyperbole and cannot be used to prove that Wright is Satoshi .
4. The claims that PGP keys used by Wright and Satoshi are “linked to the creation of Bitcoin” also lack any substance.  A PGP signature can offer concrete evidence of authorship, or verification that the person possessing the private key used to sign a specific file or e-mail message is in fact the true person behind the messages. Wright has not provided any such evidence, and this evidence should be easily provided. He could simply make a public post stating that he is Satoshi Nakamoto and sign that post with Satoshi’s original PGP key, which he has never use and can be found here: http://forum.bitcoin.org/Satoshi_Nakamoto.asc
5. Satoshi Nakamoto has never shown the desire to be a media hog or a public person, while Wright has. Satoshi has always shown the desire to be private and live in the shadows; Wright has not.
6. Wright is still mining Bitcoin. According to the Sidney police who have raided Wright’s home shortly after the Wired article was published, there was a substantial amount of equipment in Wright’s home, most likely used for Bitcoin mining. According to the landlord, Wright had a three phase, high amperage circuit pulled into the building, also indicating that a mining operation is ongoing. It is extremely unlikely that Satoshi would have a need to mine bitcoin as he mined the original genesis blocks. These bitcoin have never moved on the Blockchain since they were originally mined in January 2009. It is generally accepted that Satoshi has a ton of Bitcoin already, about 1 million of them. He would not spend valuable time and resources on mining activity that is no longer very profitable.
7. Wright is in trouble with the government of New South Wales. While this does not prove much, we can speculate that this may be a ploy by Craig Wright to create publicity to advertise his business enterprises, one of which is a “Bitcoin bank” called DeMorgan LTD, a “pre-IPO” company which would greatly benefit financially from the suggestion that its founder and majority owner is Satoshi himself. Not coincidentally, the price of Bitcoin has gone up substantially since Wright’s claims were publicized.

It appears to be quite evident that Craig Wright is not Satoshi Nakamoto. Until Wright provides some solid cryptographic evidence that he is Satoshi, Wired and Gizmodo should stick to celebrity boob-job news and try to resist the temptation to write sensational news which do not really benefit the Bitcoin community. Extraordinary claims require extraordinary evidence. And the claims that Wright is Satoshi are very poor, at best.

Virgil Vaduva is a Libertarian security professional, journalist, photographer and overall liberty freak. He spent most of his life in Communist Romania and participated in the 1989 street protests which led to the collapse of the Ceausescu regime. He can be reached at vvaduva at truthvoice.com.

A few days before the 2015 Black Friday frenzy, a number of security web sites and security bloggers have published and re-published a very well-timed and very scary report issued by iSight Partners, a security firm based out of Dallas, Texas.

The report in question was published on the iSight Partners’ website behind a data collection wall, where one has to enter name, e-mail address, title and corporate information in order to obtain the document. In essence, the release of this report appears to be little more than a marketing effort to obtain potential sales leads for this organization.

Many other organizations have regurgitated the press releases coming from iSight Partners without checking or challenging any of the statements made by their representatives.  Steve Ward, a marketing director with iSight Partners made a statement to Russia Today and The Register, “This is POS malware on steroids. We have been examining POS malware…for at least the last eight years, and we have never seen this level of sophistication in terms of development… [Engineers say] it is the most sophisticated framework they have ever put their hands on.”

Gizmodo also made the spectacular claim that this malware is so sophisticated and scare that it employs highly advanced features like ‘key-logging’, ‘network monitoring’ and ‘RAM scraping,’ all methods used by viruses and malware for decades. These claims made by various iSight employees to the media were never questioned or challenged by editors or journalists.

Maria Noboa, a technical analyst with iSight also told Fortune Magazine, “This is by far most the most sophisticated point of sale malware we’ve seen to date.”  Yet one paragraph later, Noboa claims that ModPOS has probably been around since 2012, with attacks being observed in 2013 “and likely ongoing.”  In other words, iSight has no evidence and no idea about the scope of the ModPOS infection, attack surface and the risk it currently poses to current retailers. Instead, the iSight marketing team apparently decided to throw in some key-words meant to scare an uneducated audience and wrapped it all up with “Eastern Europe” knowing that it is the epicenter of “very bad hacking things happen here.”

The iSight report is in essence a rehash of a 3 year old piece of malware, which is well-known in the security industry; the report is purposefully vague to apparently create panic and using trigger words to scare an audience into action.

The very qualified folks from Verizon Cyber Intelligence Center also did not fall for iSight’s fear mongering press release. In a very short blog post they updated their customers after they also analyzed ModPOS and determined that it is nothing other than the Backdoor.Straxbot malware; Symantec released signatures for Straxbot in December 2014. It is unclear why iSight decided to re-name this piece of malware as Symantec had existing functioning signatures in production one year ago.

The Verizon blog entry stated, “Our initial assessment of the iSight report does not support observations such as, “Most complex ever,” or “silent assassin.” These characterizations of ModPOS are hyperbole.”

Verizon is kindly calling iSight’s report “hyperbole.”  I call it fear mongering and a pathetic marketing and sales effort to scare customers into writing checks.

While iSight claimed that this report was released to help retailers maintain security awareness, I see no evidence of this. It is unfortunate that security firms like iSight use fear to sell their services and scare retailers into wasting valuable efforts on very low risk items which could be mitigated with minimum effort, and this is why such firms cannot be trusted with security contracts. If they exaggerate threats and risks in order to sell services, what else do they lie about?

The footprint and behavior of “ModPOS” has been very well documented for almost three years. The trojan creates a file %System%Drivers[RANDOM CHARACTERS FILE NAME].sys and an encrypted directory %Windir%Installer[GUID][HEXADECIMAL VALUE]. Furthermore this malware connects to a static set of IP addresses (listed below). These ModPOS c&c destination address should be blocked in an enterprise firewall in order to mitigate risk of further infection and limit the command and control functions of the package:

• 109.72.149.135
• 109.72.149.42
• 130.0.237.22
• 178.162.163.194
• 188.72.218.230
• 212.224.112.155
• 213.155.8.44
• 213.229.116.165
• 216.246.23.8
• 5.187.1.198
• 67.228.137.30
• 75.127.113.184
• 87.118.92.44
• 88.198.119.118
• 89.149.235.55
• 89.149.247.139
• 91.207.61.208
• 91.218.39.217
• 91.226.31.43
• 91.228.152.134
• 92.60.177.225
• 93.174.3.146

Retailers using non-MS Windows point of sales systems should rest assured that they are not at risk of infection. They are however at risk of wasting money on likely expensive and unnecessary services sold to them by iSight Partners.

Courtesy of CBS

By Deric Lostutter

LulzSec, a name synonymous with chaos, first appeared in 2011. “Lulz” is a mutilation of the acronym “LOLs,” and “Sec,” abbreviating “Security”. Targeting companies with hacks such as Sony Pictures, HB Gary, and Fox, 10 core members sought to teach the corporate world a lesson under the flag of Anonymous, the cyber activist group responsible for hundreds of hacking operations around the world. They wanted to show the world that they are trusting corporations with their private data, and that corporations didn’t care about their client’s safety. Other operations, they did simply for the “Lulz”. Sabu helped found the group LulzSec and worked closely with members such as Anarchaos, also known as Jeremy Hammond, to hack Stratfor, a geopolitical intelligence and consulting firm.

Hector was arrested on June 7th, 2011, after the F.B.I. raided his New York home for previous hacking charges including conspiracy to commit access device fraud, conspiracy to commit bank fraud, and aggravated identity theft. He originally faced up to 124 years in prison for those charges, but, the F.B.I. propositioned him with an offer to become an informant, continue as his alter-ego of “Sabu”, and help them catch the rest of the LulzSec group. Sabu agreed and only served 7 months in prison when initially arrested.

Since literally the day he was arrested, the defendant has been cooperating with the government proactively, sometimes staying up all night engaging in conversations with co-conspirators to help the government build cases against them. – Assistant U.S. Attorney James Pastore a secret bail hearing on August 5, 2011

Sabu would then enter “I.R.C.” or internet chat relay networks, signed in under his “Sabu” moniker and construct one of the most infamous entrapment schemes played out by the F.B.I. against cyber-vigilante group, Anonymous, ever. Under Hector’s direction, LulzSec was directed to infiltrate and extract over 200 gigabytes of data, including credit card numbers of clients, and then donate to charities such as CARE, Red Cross, and Save The Children, using the credit card numbers, (which were erroneously shown in plain text on the Stratfor servers), harvested from the databases during the breach.

Six people were indicted, across multiple continents, and given various prison terms or probation depending on their local laws and contributions to their activities within LulzSec. The most infamous sentence of them all was Jeremy Hammond’s who spread rage through the world of Anonymous when at his sentencing hearing he stated “he had no idea about the vulnerabilities of the Stratfor site, until Sabu told him, under the direction of the F.B.I.”. Hammond was then sentenced to 10 years in prison, and is currently serving his time in Manchester, Kentucky.

Sabu was later credited with the takedown of LulzSec by the federal government, credited for time served, avoiding 124 years in prison. The internet was furious. Activists would come together and campaign for the release of Hammond and the others. Casting a damning guilty verdict on Hector in the court of public opinion. Snitch, they would call him. Receiving death threats were a normal occurrence, and he then became a target for Anonymous operatives world-wide who sought a world of transparent government, free from the influence of big corporate lobbyists. Did Sabu just take down Anonymous single-handedly? Did he undo years of hard work that has led to change in both Tunisia and the United States? Why did he do it? To save his own skin? These are the questions of thousands of angry activists and political dissidents alike.

I myself know what it is like to be hated by members of Anonymous, also what it is like to be stalked, harassed, threatened, and even pushed to the point of wanting to end it all. The F.B.I raided me for my actions within Anonymous, primarily helping to expose a rape cover-up in Steubenville Ohio, and I am currently awaiting indictment with a potential prison sentence of 25 years. I turned to the media, to control the narrative and not become lost like Hammond, Barrett Brown, and so many other activists arrested. My plan has worked so far, and I remain free. Some members, (if you can call a leaderless collective group members), disagreed with my tactics, saying that I was seeking fame, not freedom. Some people associated with Steubenville have dedicated their every waking moment to stalking and harassing me, my family, my employers, and even my landlords in attempts to destroy me.

The noise that was being made in my direction caught the attention of Sabu, who messaged me on Twitter, telling me to keep my head up. I had never spoken to Hector before, but like so many others, had made my mind up about his betrayal to the mask of Anonymous. To me, he performed the ultimate betrayal. However, my mind was intrigued, curiosity piqued. Why did he care about how I, a stranger to him and a member of Anonymous, felt? Why did he proceed to give me advice to deal with the constant torment of people targeting my wife, my unborn child, and my businesses? What could he possibly have to offer?

I asked him one question, why did he help to out members of Anonymous to the F.B.I.? What was in it for him? Could he have gained financially? Was he seeking federal employment for his skills? What made it all worth it, to take away 10 years of someone’s life? I told him that I understood the wanting to stay free. He was facing 124 years and nobody was even physically injured, yet the Steubenville rapists destroyed a 16 year old girls life and only got 1 and 2 years respectively.

I, like many others, view the Computer Fraud and Abuse Act as an archaic, hypocritical law based off the fear of the movie “hackers”, released in the 1980’s. For example, it was written to pertain to military computers, before a computer was a household item, and defines a “secure computer” as anything with a microchip. These days, virtually everything in your house has a microchip. So, in theory, I could be sentenced to 5 years in prison for hacking my own PlayStation, or microwave oven. The government looks at us like magical wizards, as my previous attorney, Tor Ekeland, once put it. They don’t understand hacking, so they fear it.

Hector proceeded to tell me how the F.B.I. really didn’t need his help to identify the members of LulzSec at all. He explained that the members of LulzSec had very poor, what is commonly called, “OpSec”, or operational security. Various subpoenas of social media networks, and communications networks led the F.B.I. to the actual identities. It would seem that they just needed to trump up the charges into something significant enough for the F.B.I to prosecute, as they don’t prosecute anything under $5,000 or a misdemeanor in the computer crimes division according to my previous lawyer.

So, their poor OpSec was their downfall. Did this mean, that in principle, Hector didn’t give up his allies? I was intrigued at the thought of a secondary narrative. He explained that Anonymous met it’s downfall by registering itself on social media such as Twitter, and Facebook. The registering of your profile on these networks leaves a digital footprint that the F.B.I. can apparently trace to your actual identity, regardless of the many precautions taken by members of Anonymous. Are any of us truly Anonymous? Edward Snowden recently revealed a powerful NSA monitoring program aimed at millions of innocent American citizens, regardless of our guaranteed constitutional expectation of privacy.

Hector went on to state that he “made his own mistakes” on previously visited forums and online communities. Mistakes, which may have led to his being “doxed” or had his identity outed by the group, BackTrace Security in 2012. Referring to Jeremy Hammond as “JH” in his Twitter direct message session with me, he stated that multiple members of LulzSec outed themselves in I.R.C. or logging into their VPN (virtual private network) called HideMyAss, who cooperates with United States and international authorities when subpoenaed. Hector claims that he only provided I.R.C. chat logs to the agents who arrested him. He went on to state that Hammond was profiled by the police, in my opinion, most likely from his previous stints in jail/prison due to activism and hacking attacks, and that his chat logs confirmed his profiling by the F.B.I. leading to his arrest.

Hammond, along with everyone else involved in Anonymous knows the potential consequences for being involved with such a politically charged movement. Government fears us, free thinkers endorse us, and we are the voice of the oppressed. A powerful megaphone in the world of cyberspace, the world’s largest sidewalk to protest on. I learned those consequences when the F.B.I. came knocking on my door, on the heels of the man who hacked Steubenville booster website, rollredroll.com coming out in the Herald Star, an Ohio Valley newspaper. I knew what it was like to be snitched on, sold down the river for protection, and abandoned. I still am facing indictment that could lead up to a quarter century of my life being washed down the drain for doing the police’s job for them. 6 school officials were indicted as a result of our involvement in the Steubenville case for helping to destroy evidence relating to the rape of a minor.

So naturally, I was skeptical of Sabu’s explanation, until he mentioned his family became targeted by the F.B.I. unless he cooperated. This is something I heard of before, they pull this with high profile hackers and political dissidents, even threatening Barrett Brown’s mother with prison time if he didn’t cooperate with authorities. A defiant Barrett Brown refused their deal and eventually the Fed’s case crumbled around them, giving Brown just 5 years in federal prison.

A little reading on Sabu, and you will discover that he was a high school dropout, who was unemployed at the time of his arrest, taking on the responsibility of adopting his aunt’s daughters while she was incarcerated. Living in his mother’s house in the Riis housing project on Manhattan’s lower east side, he was struggling to make ends meet and at the same time trying to make a difference the only way he knew how,– hacking.

I, myself, know what it is like to be a victim of circumstance, but again my bias kicks in. This guy sold out his brothers in arms. But, is it really self-preservation when innocent lives are at stake? His mother could have been prosecuted, and his cousins shipped off to one of the many dilapidated foster homes in New York, forever lost in the system. One could argue that Sabu was not thinking of himself, but in fact, think about the safety of those people who were always there for him, his family.

The F.B.I. has a peculiar knack of infiltrating groups, governments, and even Anonymous, starting “in-fighting” between its members to create chaos and dissent. Operations of such have been featured in the media, torn from the pages of many declassified documents, and classified documents alike leaked by Edward Snowden and WikiLeaks. Their goal? To destroy any political group that doesn’t serve their interest. Hackers and free thinkers alike are targeted by a government, funded by corporate lobbyists, and fueled by extensive greed. The Department of Homeland Security, the F.B.I., local police, fusion centers, and private-sector paramilitary groups are sometimes referred to the Domestic Security Alliance Council. The D.S.A.C. was outed in December of 2012, for working with banks to arrest peaceful protestors of the Occupy Wall Street movement. They even went as far, as described in the legally obtained documents by the Partnership for Civil Justice Fund, to authorize snipers to carry out acts of assassinations on the leaders of the Occupy protests all over the United States.

Let’s recap what that means. Corporations, and banks, lobbied to the sworn protectors of the American people, essentially paying them off, to eliminate any dissent from constitutionally protected, peaceful protestors. They were planning (illegally) to kill unarmed American citizens. Plain dressed officers, inciting riots to discredit the movement, and stalking law abiding citizens, violating the Constitution of the United States of America. These agencies still have yet to answer for their crimes, yet demand our trust and cooperation, after labeling the protesters “Domestic Terrorists”.

There are plenty of wars in the world that the United States has dipped its hands into, but one war in particular rages on since the inception of hierarchy itself. A war that many have fell victim to, and one that may have played a crucial role in Sabu’s cooperation with the F.B.I., A war on social class.

“When the rich wage war, it’s the poor who die”.
-Mike Shinoda of Linkin Park

Police Body Cameras Shipped with Pre-Installed Conficker Virus

Old Windows worm resurfaces in modern IoT devices

US-based iPower Technologies has discovered that body cameras sold by Martel Electronics come pre-infected with the Conficker worm (Win32/Conficker.B!inf).

The specific line of body cameras iPower tested is the same one sold to police forces around the US, used by street patrol officers and SWAT team members in their operations.

The model, Frontline Body Camera, is attached to an officer’s chest and works by recording their activities on video, their location using a GPS tracker, and taking regular snapshots as images.

The camera records data on an internal drive, from where the officer or their supervisors can download it onto a computer via a USB cable.

According to iPower’s account, this is where they spotted the infection.

The worm comes pre-installed on new Martel Frontline Body Camera models

The company’s IT team was evaluating a new batch of body cameras they had just received from Martel, and after unwrapping and connecting one to a computer, they were alerted by their security solution of the Conficker infection.

In terms of malware, Conficker is a dinosaur when compared to current threats. Most antivirus engines detect it today, and very few criminal groups use it because of this.

If they do, they usually deploy it to help infections propagate, Conficker being very apt to quickly spread on local networks and disable local protections.

Conficker is again dangerous thanks to IoT devices

While detection rate is high, Conficker can still be very useful, especially today, with the proliferation of more and more IoT (Internet of Things) devices.

Since almost no IoT device can run security products and they are usually programmed without paying too much attention to self-protection measures, Conficker can be as effective in 2015 as it was in 2008 and 2009.

While the worm is almost useless on PCs because of the built-in security updates included with Windows a long long time ago, modern Internet-connected equipment is ripe for the taking.

iPower has said that they contacted Martel, but they did not receive an answer before going public with their findings a day later.

Below is a proof-of-concept video recorded by iPower’s team.

by Deric Lostutter

We all know that AshleyMadison.com – the dating site who’s slogan is “life is short, have an affair” was recently compromised by a group of hackers calling themselves Impact Team

Ashley Madison released this statement pertaining to the unauthorized access of the site.

“We were recently made aware of an attempt by an unauthorized party to gain access to our systems. We immediately launched a thorough investigation utilizing leading forensics experts and other security professionals to determine the origin, nature, and scope of this incident.”

“We apologize for this unprovoked and criminal intrusion into our customers’ information. The current business world has proven to be one in which no company’s online assets are safe from cyber-vandalism, with Avid Life Media being only the latest among many companies to have been attacked, despite investing in the latest privacy and security technologies.”

“We have always had the confidentiality of our customers’ information foremost in our minds, and have had stringent security measures in place, including working with leading IT vendors from around the world. As other companies have experienced, these security measures have unfortunately not prevented this attack to our system.”

“At this time, we have been able to secure our sites, and close the unauthorized access points. We are working with law enforcement agencies, which are investigating this criminal act. Any and all parties responsible for this act of cyber–terrorism will be held responsible.”

Impact Team threatened to release all of the information of more than 30 million users if they didn’t take AshleyMadison.com and EstablishedMen offline. The hackers chose to release 2,500 records to show they mean business. The mirrors were taken down by use of the “Digital Millennium Copyright Act” or “DMCA” requests on behalf of Avid Life Media, the parent company of AshleyMadison. It is unclear just how much information Impact Team has obtained, but the information could include credit card numbers and other financial information.

Impact Team left this message behind:

“Avid Life Media has been instructed to take Ashley Madison and Established Men offline permanently in all forms, or we will release all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails. The other websites may stay online.”

Below is a snippet left behind by Impact Team verbatim:

AshleyMadison customer service has been slammed busy in their call centers, reassuring clients that their information is secure and that only 2 records were ever compromised – a claim that was obviously false due to the evident leak that they worked so hard to take offline. Some customers are even taking advantage of a “full delete” option that rolled out because of the hack, which AshleyMadison claims will remove all user information, however, they refuse to acknowledge if it also deletes the damning credit card transaction information associated with user profiles.

With AshleyMadison lying to it’s users, one can only be sure that information is safe in corporate hands, if you never give it to them in the first place.

While the dangerous breadth of modern state surveillance has been rightfully exposed by whistleblowers like Edward Snowden, many of the forces that allow this underhanded Internet spying have gone remarkably unnoticed. In fact, an unexplored world of private sellers surreptitiously collaborates with intelligence agencies to help maintain their expansive snooping apparatuses. Thesesecurity agents for our digital panopticon receive virtually no scrutiny thanks to their privileged, yet nuanced, relationships with powerful groups (and subsequent lack of mainstream-media coverage). But this month, the shadowy world of mercenary exploit sales finally had its huge Snowden moment.

Robbert van der Steeg/FlickrIn early July, an activist hacker known as “PhineasFisher” effortlessly infiltrated the systems of a notorious Italian zero-day exploit seller, called “Hacking Team.” (“Zero day” refers to security vulnerabilities that are unknown to vendors, which “exploit sellers” often make available to the highest bidder.) PhineasFisher dumped 400 Gigabytes of documentation online for the world to browse. The trove confirmed what many in the security community had long suspected, including bombshell revelations that Hacking Team maintained business relationships with almost 40 different governments including the United States and Russia, sold spyware to brutal dictatorial regimes, and sold products that directly targeted journalists, software developers, and activists for surveillance and monitoring.

The transparency imposed on the rogue Hacking Team was incredibly valuable on its own; in fact, one of the company’s own vendors has called it a “blessing in disguise” to shed light on the industry and begin a discussion of zero-day sales reform. But the Hacking Team hack also provides important lessons about the broader security ecosystem and the thinning line between private and public entities as we adapt to the age of hacking without borders.

The Hacking Team was typical of an above-ground business operating legally in the exploit market. Like Germany’s Trovicor, France’s Amesys, the UK’s BlueCoat, and previous PhineasFisher target Gamma International, Hacking Team profits by selling exploits of popular computer software to powerful groups under the guise of “cybersecurity.” When firms offer to look for and report any vulnerabilities so the firm that hired them can patch up and improve their software, this can be a wholly legitimate and beneficial trade. Often, however, these groups merely sell governments different ways to spy on or manipulate political enemies and even innocent citizens.

Indeed, the difference between these kinds of groups and the more stereotypical, hoodie-wearing, lone wolf hacker-for-hire is often one of style rather than ethical substance. Both of these groups make money by discovering or purchasing unknown computer bugs and selling them to governments, political parties, or even terrorist groups for a healthy mark-up.

Zero-day vulnerabilities are incredibly useful to parties wishing to unknowingly manipulate other people online. They are a bit like having a monopoly on a secret entrance to a popular computer program that only you know about. Zero-days can be exploited to remotely inserted malware or spyware that will activate anytime a user sends an online payment or updates iOS or runs Adobe Flash Player. (Incidentally, it might be a good idea to uninstall Flash for now, since we now know Hacking Team sold not one but two Flash exploits.) Other times, exploit merchants use vulnerabilities that are already known and target people running older, unpatched versions of popular software instead. This type of exploit service constituted the bulk of Hacking Team’s portfolio.

The trade in software exploits to further government surveillance is troubling enough from a privacy perspective. Activist groups such as the Electronic Frontier Foundation (EFF) and Reporters Without Borders have long criticized such practices for violating human rights and expanding the global net of digital surveillance.

But there are grave security implications as well. Selfishly hoarding zero-day vulnerabilities intentionally ensures that the Internet will remain systemically insecure. Going a further step and exploiting any kind of vulnerability for political surveillance or oppression could potentially introduce catastrophic weaknesses beyond the scope that the initial exploiters ever anticipated. A responsible netizen finds a zero-day and reports it to the public so that we can all be more secure. An unscrupulous sociopath sells it to Ethiopia for $1 million to crack down on U.S. journalists and wreck huge parts of the Internet in the process.

Security researchers pored through the Hacking Team document-dump on Wikileaks to determine which software vulnerabilities Hacking Team was selling so they could warn the public about which products needed to be updated or uninstalled. They have found three zero-days so far: the two Flash bugs and another for the Windows kernel. While those who practice good cyber hygiene will be able to inoculate themselves against these revealed exploits, the vast majority of less sophisticated Internet users may still be vulnerable to attack as prepackaged “exploit kits” of all three bugs are being sold to newbie hackers.

It is clear that “security” was far from the top priority for Hacking Team because their own security sucked. Hacking Team was not a sophisticated cybercastle whose alligator-filled moat nonetheless failed, it was an inflatable bounce-house with a paperclip lock. Their password was “P4ssword“—when it wasn’t “wolverine,” “universe,” or “Pssw0rd,” that is. In the middle of a sensitive email exchange with an outside associate, Hacking Team COO Giancarlo Russo suddenly remembers to ask, “Do you have PGP [email encryption] by the way? We really do need to encrypt these emails.” This one moment of late foresight is far outweighed by the firm’s incomprehensive encryption and poor user operational security.

By not-so-secretly stockpiling destructive exploits and engaging in ample public boasting, Hacking Team was more or less begging to be attacked. Their one-stop-shop arsenal of poorly-protected cyberweapons proved too tempting a target for rival hackers. Really, Hacking Team CEO David Vincenzetti should have known better. A veteran of the anti-authoritarian, pro-privacy Cypherpunk hacking movement, Vincenzetti cut his radical teeth developing a “file tampering detector” that would identify and repel intruders like Hacking Team from computer systems in 1992.

But Vincenzetti has changed quite a bit since the days when he participated in the same listservs as Wikileaks founder Julian Assange and EFF co-founder John Gilmore. His security chops have certainly suffered. Despite being an early promoter of email-encryption software, emails show thatHacking Team hardly used PGP at all.

More fundamentally, the “freedom hacker turned government tool” angle of the Hacking Team story reveals the unfortunate incentive structure presented to the tiny elite of hackers capable of building—or breaking—the global surveillance network that tracks our every online move. They can choose to fight or expose the system, risking media demonization, foreign asylum, and even lifelong prison sentences for the heinous crime of defending our freedoms online. Or they can sell out and enjoy fat retirements as cyberweapons dealers of choice for the world’s repressive states. Either way, this episode is an important reminder that the enemies of an open Internet are not limited to the state.

Written by Andrea Castillo for Reason Magazine.