Slashdot Mirror
Downloads of Popular Apps Were Silently Swapped For Spyware in Turkey: Citizen Lab (www.cbc.ca)
Matthew Braga, reporting for CBC: Since last fall, Turkish internet users attempting to download one of a handful of popular apps may have been the unwitting targets of a wide-reaching computer surveillance campaign. And in Egypt, users across the country have, seemingly at random, had their browsing activity mysteriously redirected to online money-making schemes. Internet filtering equipment sold by technology company Sandvine -- founded in Waterloo, Ont. -- is believed to have played a significant part in both.
That's according to new research from the University of Toronto's Citizen Lab, which has examined misuse of similar equipment from other companies in the past. The researchers say it's likely that Sandvine devices are not only being used to block the websites of news, political and human rights organizations, but are also surreptitiously redirecting users toward spyware and unwanted ads. Using network-filtering devices to sneak spyware onto targets' computers "has long been the stuff of legends" according to the report -- a practice previously documented in leaked NSA documents and spyware company brochures, the researchers say, but never before publicly observed. Citizen Lab notes that targeted users in Turkey and Syria who attempted to download Windows applications from official vendor websites including Avast Antivirus, CCleaner, Opera, and 7-Zip were silently redirected to malicious versions by way of injected HTTP redirects. It adds: This redirection was possible because official websites for these programs, even though they might have supported HTTPS, directed users to non-HTTPS downloads by default. Additionally, targeted users in Turkey and Syria who downloaded a wide range of applications from CBS Interactive's Download.com (a platform featured by CNET to download software) were instead redirected to versions containing spyware. Download.com does not appear to support HTTPS despite purporting to offer "secure download" links.
That's according to new research from the University of Toronto's Citizen Lab, which has examined misuse of similar equipment from other companies in the past. The researchers say it's likely that Sandvine devices are not only being used to block the websites of news, political and human rights organizations, but are also surreptitiously redirecting users toward spyware and unwanted ads. Using network-filtering devices to sneak spyware onto targets' computers "has long been the stuff of legends" according to the report -- a practice previously documented in leaked NSA documents and spyware company brochures, the researchers say, but never before publicly observed. Citizen Lab notes that targeted users in Turkey and Syria who attempted to download Windows applications from official vendor websites including Avast Antivirus, CCleaner, Opera, and 7-Zip were silently redirected to malicious versions by way of injected HTTP redirects. It adds: This redirection was possible because official websites for these programs, even though they might have supported HTTPS, directed users to non-HTTPS downloads by default. Additionally, targeted users in Turkey and Syria who downloaded a wide range of applications from CBS Interactive's Download.com (a platform featured by CNET to download software) were instead redirected to versions containing spyware. Download.com does not appear to support HTTPS despite purporting to offer "secure download" links.
... of living in a dictatorship. Well one of them anyway.
But are you Hungary for more? Government corruption makes me always more Hungary.
however, I never download anything without vetting what I've downloaded, either by dint of checking the checksum or emailing the developer should I think something is dodgy. Having worked in IT security for many years, I know what dangers lurk out there. I do the same for my iPhone. I have never found myself wanting an app that Apple has not included. I don't do my banking on my mobile. Ever. I live close enough to the city centre where I can simply visit my bank should I need to do so. And, what with the telemetry of Windows 10, it's constantly refreshing to use a very locked down version of Fedora Linux with SELinux and Tripwire keeping the evil at bay. I also run a Raspberry Pi/Pi-hole combo as well as uBlock Origin, Decentraleyes, Privacy Badger, Referer Control, JS Control, and No Coin. I take additional steps as well like using a VPN. I routinely keep track of my log files and have software to detect random redirects and block as required. The web has become a dangerous place with evil actors. It's a wonder we don't hear about more breaches and people getting owned.
Even seemingly irrelevant content. This day in (the WWW's) age gives no excuses beyond being too lazy to update legacy websites and platforms. It should be the default everywhere and there should be a GOOD reason to transfer anything unencrypted.
It is pitch black. You are likely to be eaten by a grue.
So Sandvine are a bunch of scumbags who sell surveillance and malware tech to oppressive regimes that endangers journalists, political activists, and anyone associated with them, eh?
Debate is a form of harassment. Do not question my truth.
Was Hungary and ate Turkey, but slipped on Greece and broke China, then shitted into Israel.
It's becoming increasingly clear that no turk living today will ever see their dream of someday joining the EU realized in their lifetime.
Turkey is another perfect example of collective gullibility, where a majority democratically and freely chose a leader because they were clueless enough to actually believe him when he told them he would respect democracy and freedom once in power.
Frankly, I'm getting sick and tired of seeing country after country falling for the same old crap that's been going on for millenia time and time again. A supposedly intelligent species that simply cannot learn from the mistakes of its past and repeats them again and again and again is a textbook example of an evolutionary dead-end.
This add on no longer causes problems and will avoid http injection attacks
I am Finnished reading this subthread. The whole thing was Russian towards silliness.