Tag Archives: Safari

Apple on Safari, gunning for Facebook?

Updates to Anti-Social Media 

John E. Dunn for Sophos: Apple says no to Facebook’s tracking
“Later this year, users running the next version of Apple’s Safari browser on iOS and macOS should start seeing a new pop-up dialogue box when they visit many websites…this will ask users whether to allow or block web tracking quietly carried out by a certain co”mpany’s ‘like’, ‘share’ and comment widgets.” And the dialog text in the demo to which the article refers specifically mentions Facebook.

On the other hand: Caleb Chen for Privacy News Online: Apple could have years of your internet browsing history; won’t necessarily give it to you – “Apple has years of your internet browsing history if you selected “sync browser tabs” in Safari. This internet history does not disappear from their servers when you click “Clear internet history” on Safari  … Additionally, the data stored and provided seems to be different for European Union based requesters versus United States based requesters. Discovering these sources of metadata is arguably one of the side effects of GDPR compliance. ”

New York Times: Facebook Gave Device Makers Deep Access to Data on Users and Friends –
“The company formed data-sharing partnerships with Apple, Samsung and
dozens of other device makers, raising new concerns about its privacy protections.” And commentary by Help Net Security: Facebook gave user data access to Chinese mobile device makers, too

James Barham of PCI Pal for Help Net: Shape up US businesses: GDPR will be coming stateside  – “European consumers have long been preoccupied by privacy which leaves us wondering why the US hasn’t yet followed suit and why it took so long for consumers to show appropriate concern? With the EU passing GDPR to address data security, will we see the US implement similar laws to address increased consumer anxiety?” And yes, Facebook gets more than one mention here.

David Harley

Advertisements

Resource updates 20th March 2018

[Update to Ransomware Resources page, also posted to Chain Mail Check]

If I had a separate category for ‘miscellaneous extortion’ this might belong there. Included here because it isn’t just a hoax, but one that centres on extortion, though it looks as if the point is to embarrass/harass the apparent sender of the extortion email (the Michigan company VELT)  rather than actually make a direct profit from extortion. The company’s CEO told the BBC that the attacker was probably a Minecraft player who had been banned from using the Veltpvp server, by way of revenge.

[Updates to Cryptocurrency/Crypto-mining News and Resources]

[Update to Tech support scams resource page]

Sophos: Fake Amazon ad ranks top on Google search results. “Yep, not for the first time, Google’s been snookered into serving a scam tech support ad posing as an Amazon ad.”

[MacVirus news]

(1) Commenting on Symantec’s warning of a new Fakebank Android variant, Graham Cluley reports: This Android malware redirects calls you make to your bank to go to scammers instead – “MALWARE HELPS SCAMMERS TRICK YOU INTO THINKING YOU’RE SPEAKING TO YOUR BANK.”

The Fakebank malware is only targeting South Korea, right now, but Graham rightly suggests that the same gambit is likely to be re-used elsewhere.

(2) Apple has dealt a major blow to users of supercookies with a security improvement in Safari.

David Harley

Pop-up Support Scams and iOS

[My colleague Josep Albors, knowing of my interest in support scams, recently contacted me about the spate of support scam alert messages reported by some users of iOS devices, the idea being to persuade the victim to ring a scammer ‘helpline’ by making them believe that they’re talking to a legitimate helpdesk about a real problem. Here’s a summary of the Spanish-language blog he wrote following our conversation. This article will be added shortly to the tech support scam information resources on this blog.]

Telephone scams that masquerade as support services have been with us for years. In fact, our colleague at ESET, David Harley, is an expert on the subject and has spoken at length on the topic in the blog WeLiveSecurity .

Over the years, criminals have honed their techniques, trying to increase the number of victims drawn into this deception. Today we will discuss one of the most recent cases of support scams, mainly targeting users of iPhone and iPad devices.

ALERT

This time the criminals have changed their approach and are no longer cold-calling their victims passing themselves off as support service staff trying to help victims solve non-existent problems on their computers (at a price, of course). In this instance, they are looking for users to call them after seeing some troubling ‘alerts’ on their devices intended to make them think that something is wrong with their system.

In the last week or two several users (mainly in the US and UK) have reported seeing an alert window in the Safari browser on their iPhones and iPads. Our colleague David Harley addressed this specific issue in his blog about threats to Mac and IOS .

Victims see a screen popup that indicates that the system has crashed because of a third party application and advises them to call a phone number for an immediate solution.

The peculiarity of this popup is that, however much you press the OK button, the message will still appear in your browser, even if you close it and return to open.

Fortunately, it’s possible restart the browser and close the tab before it is loaded (or take a more drastic measure by deleting all browser history) so as to remove this annoying message. The purpose of the scammers is to make victims believe that there really is a problem so that they will make the phone call, whereby the scammers will ask for money in order to solve the non-existent problem.

Here’s the format of a typical message of this type:

[URL of scam site]
Due to a 3rd party application in your phone,
iOS is crashed Contact Support
for Immediate Fix.
[US toll-free number]
[OK]

Other variants claim that clicking OK will send a bug report to Apple and state explicitly that the ‘support line’ number is Apple’s.

DETECTION OF THIS THREAT

It is easy to fall into such traps where the default browser (Safari in this case) does not react to this kind of deception and does not block malicious sites as some other browsers do.

If you try to access a malicious web site with Chrome or Firefox from a desktop computer, you will see a warning that you have been targeted by a phishing attack and access to the malicious web page will be blocked.

Some security solutions will also detect this website as a potential phishing threat if you access it from your browser on a desktop system, or indeed on an Android device.

CONCLUSIONS

David Harley comments:

There are a couple of interesting aspects of this variation on the support scam: one is that it’s a further indication of a trend away from cold-calling and towards luring potential victims into calling the scammer. In the past it’s also been done by seeding social media sites with testimonials, or fake support sites using scraped content and dubious generic advice, as Martijn Grooten and I discussed in a blog some years ago.

There have also been many reports recently of tech support services advertised in the US where calling gets you into a conversation with someone using very similar, misleading sales techniques as those we associate with the classic cold callers from Indian call centres: see, for instance, http://www.welivesecurity.com/2015/06/03/confessions-support-scammer/ Tellingly, one of the ‘confessions’ I quoted there made the point that:

Basically we had “marketers” who would put pop ups on people computers saying that they may be infected with a virus and giving them a number to call.

The advantage of seeding the internet with fake pop-ups is that the technique has the potential to work across almost any platform, depending on how secure the browser technology is. (For instance, similar attacks have been reported on OS X/Safari very recently.)

The third interesting point – though it actually follows on from the second – is that when people call you to describe their problems, you don’t have to invent over-used gambits like the Windows-specific CLSID and Event Viewer tricks to convince them that they have a problem. So again, it’s platform non-specific.

It seems clear that criminals continue to incorporate new techniques to ensnare new victims. As far as telephone scams specific to fake support are concerned, the claims we see are more-or-less complete fiction, but we will watch with interest to see what further innovations they come up with.

Josep Albors