Presentation on DNS Poisoning at CALUG (Columbia Area Linux Users Group)

It’s been a while, but in September 2017, we did a presentation at the Columbia Area Linux Users Group (CALUG) on how to use DNS Poisoning (using IvyDNS as a case study) as a means of protection against Corporate Surveillance and how it can be used to increase your on-line Privacy and Security.

The presentation was called “NXDOMAIN is where it’s at! Using DNS Poisoning as another layer in your Security Onion to enhance your on-line Privacy & Security“. You can take a look at the presentation and what we talked about over here.

Google has quietly dropped ban on personally identifiable web tracking

Google has reversed an earlier made promise on privacy and will now allow personally identifiable web tracking:

We may combine personal information from one service with information, including personal information, from other Google services — for example to make it easier to share things with people you know. […] Depending on your account settings, your activity on other sites and apps may be associated with your personal information in order to improve Google’s services and the ads delivered by Google. […]

Read more at https://www.propublica.org/article/google-has-quietly-dropped-ban-on-personally-identifiable-web-tracking or on https://soylentnews.org/article.pl?sid=16/10/22/0154217

IvyDNS protects you from tracking that is done by these large players. Sign up with IvyDNS to protect your privacy on-line.

Tool in the Spotlight: Pure URL

This month’s Tool in the Spotlight: Pure URL, a Firefox extension that removes tracking query string fields like “utm_source=*” from URLs (the homepage of its creator is over here. NOTE: while, according to the add-on web page, the tools declares to be available under the GPL v3.0, we can’t find the location of its actual source code).

What makes us excited about this add-on is that it automatically modifies and strips all unnecessary query string content (e.g. “utm_source=*” but others as well) from URLs that it encounters while you are browsing. Many sites embed these query string elements in links that they provide in order to track you, their advertisement campaigns, conversion sources, etc.
But these fields are of no use to you and even work against your best interests.

What Pure URL does, is turn a hyperlink like this:
https://www.domain.com/?page=7741&utm_source=somesite.com&utm_medium=RSS&utm_campaign=mail
into the more reasonable:
https://www.domain.com/?page=7741

By default, Pure URL treats and removes the following unnecessary query string elements (lifted and modified from the extension’s web page as of writing of this article):

  • utm_source, utm_medium, utm_term, utm_content, utm_campaign: spyware fields used by Google Analytics
  • yclid: spyware fields used by Yandex
  • feature: a useless field used by youtube.com
  • fb_action_ids, fb_action_types, fb_ref, fb_source, action_object_map, action_type_map, action_ref_map: spyware fields used by Facebook
  • ref, fref, hc_location: tracking fields used by Facebook
  • ref_: tracking field used by imdb.com

Pure URL strips out these query string values from hyperlinks by default and lets you specify which others you want it to strip as well (and – but why would you do this – which ones of the above, you want to keep).
One word of caution: it is unclear whether or not it prevents these values from being submitted to servers when you make a request containing these values yourself. In other words: it is unclear whether or not this add-on only modifies your DOM or whether it also modifies your requests. This can be an issue when you click on links containing these values in another program (e.g. e-mail client) which then opens up the page in your browser.

While IvyDNS already protects you against this type of tracking on your end, it is useful to have a multi-layered approach to your online security and privacy. Pure URL is a nice addition to these layers which also prevent the server-side from tracking you through these query string values.

NOTE: we are entirely unaffiliated with whoever produces this tool, we receive no compensation whatsoever from them.

The fallacy of “personalized advertising”

When peddlers of on-line advertising talk about their product, they hail ‘personalized advertising’ as a good thing, something you should actively want because, so they claim, “it is relevant content”.
But if you think carefully about it, you soon realize that this framing of the situation starts from an incorrect premise, namely that it is OK to be abused by adverts and that personalization of these ads is a cherry on top of the cake.

We disagree with this for at least the following reasons:

  • By definition, advertising is manipulative: its sole purpose is to change your behavior or opinion in favor of the advertised product or service.
  • Advertising interferes with what you are doing. Think about the last time you said to yourself “I’d love to watch some (on-line) ads now instead of doing what I set out to do”. Take your time…
    Almost no-one likes ads or is eagerly anticipating whatever they are trying to do or accomplish, to be interrupted by an ad.
  • Most people reluctantly accept advertising as a necessary evil, a way to fund things that would otherwise not get funded. This in itself is a huge indemnification of advertising and shows that, fundamentally, it is not something we desire, instead, we endure it… (even though there are ways to pay for these things; just search for the “(digital) subscription” link on, for instance, your favorite on-line news provider)
  • Personalized advertising, by definition, requires an invasion of your privacy: it only works if and when you tell third parties things about you that you would otherwise never reveal. This is so that the system can get to know you, can learn about you and figure out which impulses you are most vulnerable to.
  • Personalized advertising works against you: it finds your weaknesses by following you everywhere and then exploits what it finds in order to cajole you into performing actions you would otherwise not perform, namely spending your hard-earned money.

Personalized advertising is not acceptable and is really nothing more than an admission that “we realize everyone hates ads, we’re going to make the pill less bitter by trying to serve you ads that our system thinks you will object to the least“.
A pill less bitter, is still a bitter pill.

IvyDNS protects you from abuse by advertisers and other miscreants, whether it is theft, exposing you to malware or an invasion of your privacy.

Advertisers know exactly who you are… the data is NOT anonymized

Advertisers know who you are, where you go, when you go there and how much time you spend where you are: Advertisers will be able to upload email lists to target customers and similar audiences with ads on search, Gmail and YouTube.
This shows, yet again, that the claims about the data being anonymized, are false. This capability enables advertisers and those buying advertising time/space from (in this case) Google, to say “here’s an individual I want to show my ads to”(*).

What was that about “we don’t know who you are, you’re just an anonymous number to us“, you say?
When the number is you, uniquely you, then you’re not anonymized, instead, you’ve been given an (additional) alias which makes it easier to be identified, not harder.

IvyDNS prevents you from ever being recorded as one of these (non-)’anonymous numbers’ in the first place. And even if you were recorded in the past, it makes your future footprints melt away before anyone gets a chance to see them.

(*) Interestingly, this also opens up a mechanism for those using advertising networks as delivery mechanisms for malware, to target very specific individuals for infection with their malware.

Tool in the Spotlight: Random Agent Spoofer

This month’s Tool in the Spotlight: Random Agent Spoofer, a Firefox extension that gives you control over how your browser identifies to sites you visit.

Many sites create a fingerprint of you when you visit them. Usually, this information contains the ‘User Agent’ string, which (oversimplified) is a combination of the name of your browser, its version together with the name of your operating system with its version (this is much oversimplified, check out the wikipedia page for more info). This is useful information for those operating the sites you visit because it enables them to send you content that is specific to your browser. Specifically, if the site detects that you are visiting them using a mobile browser/device, it will send the mobile version of the site; if it sees a desktop browser or device, it sends the desktop version of the site.

However, with HTML5 and CSS3 in specific, websites no longer need to have multiple versions for different browsers, they can use “media selectors” to have the site render correctly instead.

The remaining use of the user agent string is being reduced to just fingerprinting you so that you can be uniquely identified based on what your browser tells the site it is and is capable of using a technique called browser fingerprinting. So even though you aren’t logged into the site, it knows it is you before you told it that it is you. Obviously, we are not a fan of this kind of thing. No-one should be forced to identify or legitimize themselves unless out of their own volition.

Enter “Random Agent Spoofer“, a tool that is part of the solution by changing the way your browser identifies to sites. It makes it super easy to select a particular browser and version you want to impersonate or you can set it up to change how it identifies every so often by itself. Once configured, there’s nothing you need to do.
Obviously, and similarly to other tools we highlight, this tool is not the one, single tool to use which will solve all your problems, but it adds to making it harder for sites to identify you as you visit them.
On top of that, Random Agent Spoofer gives you control over script injection, cookie behavior, headers sent to the site when you request it, etc… all making it harder for the site to figure out who you are (and make their efforts to do so, more frustrating and less accurate).

Check out the tool at https://addons.mozilla.org/en-US/firefox/addon/random-agent-spoofer/. This tool is an open source tool currently hosted on GitHub, which means that you can look at the source code and figure out what exactly it is that it does, and how it does it – if that’s your thing (it is for us).

NOTE: we are entirely unaffiliated with whoever produces this tool, we receive no compensation whatsoever from them.

Power in the Age of the Feudal Internet

While this article is already a couple years old, someone recently reminded us about it.
The Internet started out as a way to build resilient systems: systems that could deal with black-outs or the disappearing of a server. And if one went down, we’d just prop up another one.
When ‘Cloud’ was the newest buzz-word, we were told that it would give us flexibility: if we didn’t like our current provider, we could pick up and move to another – it’s all in the cloud anyway, whether it’s over here or over there, it doesn’t matter, right?
Sadly, the cloud has become a mist. A mist preventing us from seeing what could have been. It prevents us from venturing out because we can’t move from one provider to another.

Regardless of how you feel about it, “Power in the Age of the Feudal Internet” is an interesting read.

Advertising networks are delivery mechanisms for malware

The Register published an article on how advertising networks used by major and popular sites are (yet once more) being hijacked by malware peddlers. IvyDNS eliminates this attack vector and keeps you safe when you are online.

It’s just another reason to no longer treat advertising as ‘harmless’ or ‘a minor nuisance’: allowing content from unknown third parties to be downloaded to and executed on your devices is a major security risk that can lead to compromised devices and can include identity theft.

A two-year long, highly sophisticated malvertising campaign infected visitors to some of the most popular news sites in the UK, Australia, and Canada including Channel 9, Sky News, and MSN.

Readers of those news sites, just a portion of all affected (since it also affected eBay’s UK portal), were infected with modular trojans capable of harvesting account and email credentials, stealing keystrokes, capturing web cam footage, and opening backdoors.

The news sites are not at direct fault as they displayed the advertising; the ad networks and the underlying structure of high-pace and low-profit margins is what lets malvertising get its huge impact.

Read the full article over here.