Thor's OS Xodus

The following is an excerpt from Thor's OS Xodus by author Timothy "Thor" Mullen with Katherine Ridgway and published by Syngress. This section from chapter one explores OS X, privacy, and online safety.

I feel confident in saying privacy and safety will be the most important concerns you will have (or should have) in your online life. And if they aren't now, they will be as time passes on.

For purposes of this chapter, I'm defining "privacy" as the level of control one has over their own personal information as well as the level of control one has as it regards personal information other people own. "Online safety" is primarily the ability to prevent unauthorized code from being executed on a system, including the specific controls one has in place to prevent code execution. That extends to preventing information disclosure, unauthorized access to files, application permissions, and so forth.

In actuality, privacy and security are fibers of the same cloth. They can be distinct concepts on their own, or they can be intimately entwined with each other. As such, I'm not going to try to classify every risk we discuss as one or the other; you are smart enough to switch to OS X, so you are smart enough to figure that part out.

I'll be discussing techniques and procedures specific to OS X, those distantly related to OS X, and in a case or two, processes that stand on their own irrespective of the OS one may be using. It's all part of the Big Privacy Picture, and though it may deviate a bit, I consider it required reading material. I'm calling this "logical security" as it does not apply to any particular technical security control, but rather behavioral changes you may wish to make in order to protect your data. So let's get started.

Internet advertising is the bane of the internet, and the core driver of the deep, vast violation of your personal privacy. These days, ad "impressions" don't mean anything. An ad "impression" is where there is some ad on a page somewhere, where the host assumes you looked at it; then bills the advertiser for aggregated impressions. Today, the "conversion" is the golden egg.

You are the goose who wasn't aware you laid it. The conversion is where you are on a site, see an ad, click it, and end up buying whatever the advertiser is selling. Those are big money. It's such big money that the advertising hosts (those who produce the ads for the host site) have technology where they collect and analyze your personal information and browsing history to not only provide an ad, but to provide an ad specially selected for you, based on your browsing patterns and purchase history. The way they can track your movements to sites where you purchase products are via cookies and other bits of shared information.

So, how comprehensive is this data, you ask? It is so comprehensive that government agencies and law enforcement routinely ask folks like Google for your individual profile history and any other personal information you may have given them by virtue of the EULA (End User License Agreement) you agree to by using their service.

Think about that for a moment. Here we have the NSA building, a 1.5 million square foot data capture facility, to harvest phone calls, emails, searches, and anything else you may do where a signal is emitted. We have 37,000 FBI agents running about and who knows how many CIA agents.

Even with all of this brainpower, manpower, and the 65 megawatts of power at the new NSA facility, government agencies get their "personal profile" information from a public advertising engine service. That should tell you how much of your life Google stores, and sells.

You now might be asking, "How many requests are made by government entities for Google users?" Well, I'll tell you. Insofar as the data requests for a particular user, there were 21,389 in the six-month period ending on 12/31/12. That's all the data requested by that user for an undetermined amount of time.

Even worse, agencies requested specific, personal information from the actual Google account held by the user 33,634 times in the same 6-month time frame.

It doesn't take a genius to ascertain that the volumes of data Google has on you and me is far more than we may have considered, to the point Law Enforcement uses it to take some manner of legal action. That's scary stuff. I could go into the legal ramifications of a judge actually thinking that data has any evidentiary value, but we'll have to wait until later for that.

Before we tackle the problem of protecting that information, let's see exactly what data Google collects and what data they give away (or sell). According to Google's own privacy statement, they collect:

1. User account information like name, address, credit card numbers (where applicable), pictures, and might even create a Public Profile you don't even know about.
2. What Google services you use, what web sites you view, and everything you do when looking at or clicking ads, including what specific ad it is. Cookies regarding your habits are also shared with any number of third parties. And obviously the gmail traffic you create including sending to and received from data.
3. Phone logs like your phone number, phone numbers you call, forwarded calls, duration, where and when the call was made, SMS "routing information" (whatever that means), and finally, once they figure out it is you by cross-referencing data, they will link your phone number to your Google profile.
4. Full set of information about the computer you are using, such as your hardware make and model, your OS, browser information, unique IDs of hardware, etc. This data alone can easily and uniquely identify you as a specific user. This data is then linked to your profile.
5. Many applications use Google APIs. Map location is one, music streaming another. Google logs things like your GPS location, other information from a mobile device, what Wi-Fi areas you are in (again, including GPS location).
6. They know what applications you install or uninstall, what applications you have, how and when you use them under the auspices of "auto-update" checks in the order of four or six times per day.

You know, little stuff like that. Google does, however, say they have strict policies in place regarding the disbursement of your data. These include the provision to share all of your data with:

1. Law enforcement, government entities like the IRS or Homeland Security, or whatever agency asks and they see fit to comply with.
2. To "affiliates," businesses or people they "trust" or who say they will access the data in "good-faith," Google employees, partner companies, and that guy from Burger King who sings "ding fries are done." And my favorite (directly quoted) where they produce data, apparently to anyone, to "detect, prevent, or otherwise address fraud, security or technical issues." So if your video won't go to 1900×1200, that's a technical issue, so someone can ask for your data.
3. Other sarcasm aside, this I take quite seriously. Buried in their "we use SSL to protect you" bits, they say they also "restrict access" to "employees, contractors, and agents."

What that means is the data you thought was encrypted from end-point to end-point really isn't and they decrypt (or simple redirect an SSL end-point to standard HTTP traffic) your data and store it. Yes, that would be the data you thought was secure.

It's a "death by a thousand cuts" thing -- a little bit of data here and there isn't that big of a deal. But when there are so many different sources of data for you, the accumulation of it all creates a real issue. And obviously a huge monetary stream.

I don't want to make it look like I'm singling Google out (even though I am) because there are other, albeit smaller, offenders as well. If you were not aware of it, Microsoft has been trying for a long time to make headway into the advertising industry. In my opinion it's a failed endeavor, as they have already had to write off over 6 billion dollars for the purchase of a single company to support the Ads Platform. Regardless, since they couple with Bing and other Microsoft "owned and operated" sites, their data-mining is also a source of significant concern, given you may stay logged into your Windows Live ID (WLID), or "Microsoft Account" (or whatever they may call it now), in perpetuity for mail, with third-party sites using WLID to authenticate you.

I'll give you an example of the reach this type of tracking can give. Let's say while at work you logon to a Microsoft service such as Windows Live Mail and leave that page up while doing other things. Then you go to Bing to search for something -- that data is stored based on your WLID. You then search for "stereo systems" or some such and select a link to Best Buy. They store that too, as does Best Buy. Oh, all other data is stored as well, such as what work research you are doing, and the contents of any email you may send out or receive. At quitting time, you close out of everything and go home from work. After dinner, you go down to your XBox to play Forza Motorsport or something of the like. You have to log onto XBox Live to play the game, and when you do, your profile data is made available to whatever processes XBox decides they can send out. There used to be a company called Massive, which delivered targeted ads to video games. Microsoft purchased that company, so now you've got your data all tied up in a nice little bow. As you drive around the track, you see various billboards and such. As you do so, the video game makes a request to the ad tracking system for an ad to put on the billboard in the game. Your WLID is transferred to the ad delivery mechanism along with identifying information about your profile. Based on that connection, a behavioral targeting call is made and before you can even start into a turn you see a billboard ad for Kenwood Stereo Systems based on your search earlier at work. Massive actually went to the trouble of determining how much Kenwood should pay on the ad delivery, based on how long it was visible, what angle you were at when you saw it, and how much of the full ad you could have viewed.

Scary, huh? This happens billions and billions of times a day, all day, everyday, to countless numbers of other websites and data harvesters.

There are other, and in some ways greater, evils playing this game. If you were wondering, this is where I mention Facebook. Facebook is a massive "in service" ad engine, but also has a web of affiliates giving and taking your personal data. The reason Facebook has that "keep me logged in" checkbox is so they can stick to what they say their privacy policy is while also keeping that cookie alive so that all the affiliate sites you go to can get ad data from Facebook while passing back as much information as they have on you. In fact, even if you are not logged in, sites will actively create objects redirected to Facebook to contribute to the Global Fleecing.