Comments on: Snoop onto Them as they Snoop onto us http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/ Information Security Think Tank Sun, 23 Nov 2008 16:27:32 +0000 http://wordpress.org/?v=2.6.3 By: Google History http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36971 Google History Wed, 25 Jul 2007 08:56:40 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36971 [...] of some Security Blogs / Sites.  Around two three days back when i was going the lasts article in GNUCitizen, i got intrested with one article. Which was explaining about a Security issues on Google Web [...] [...] of some Security Blogs / Sites.  Around two three days back when i was going the lasts article in GNUCitizen, i got intrested with one article. Which was explaining about a Security issues on Google Web [...]

]]> By: pdp http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36882 pdp Tue, 24 Jul 2007 16:40:14 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36882 imipak, sorry I cannot get what you are trying to say. Yes, in order to get the WebHistory you have to have the account credentials and yes, in order to root a system you have to have system access. What's the difference? imipak,

sorry I cannot get what you are trying to say. Yes, in order to get the WebHistory you have to have the account credentials and yes, in order to root a system you have to have system access. What’s the difference?

]]> By: imipak http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36836 imipak Tue, 24 Jul 2007 10:29:31 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36836 <blockquote>the real danger is that if someone has your account details, they could potentially become your invisible stalker.</blockquote> ...but if they have your account details, they can log read/write your email as well. This seems little different from "root on your system can install software that can monitor all your activies!" - yeah, password auth is crap - we know that...

the real danger is that if someone has your account details, they could potentially become your invisible stalker.

…but if they have your account details, they can log read/write your email as well.

This seems little different from “root on your system can install software that can monitor all your activies!” - yeah, password auth is crap - we know that…

]]> By: pdp http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36637 pdp Mon, 23 Jul 2007 05:20:19 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36637 kuza55, please understand that in order for someone to access your WebHistory they need to have your username and password on first place. This means that they can simply enable the feature if it is disabled. As I mentioned before: <blockquote>keep in mind that the purpose of this post is not to show how to own people but elaborate on what can be done after that. I mean, if the attacker has access to your account, they may as well turn the WebHistory ON if it is OFF. All attackers want from you is to get your secrets. Consider it like the situation where you have a physical/remote access to a machine and now you want to install a rootkit or keylogger.</blockquote> kuza55,

please understand that in order for someone to access your WebHistory they need to have your username and password on first place. This means that they can simply enable the feature if it is disabled. As I mentioned before:

keep in mind that the purpose of this post is not to show how to own people but elaborate on what can be done after that. I mean, if the attacker has access to your account, they may as well turn the WebHistory ON if it is OFF. All attackers want from you is to get your secrets. Consider it like the situation where you have a physical/remote access to a machine and now you want to install a rootkit or keylogger.

]]> By: kuza55 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36631 kuza55 Mon, 23 Jul 2007 03:22:43 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36631 pdp: Alright, it might be opt-out on the sign up page, but its not enabled for people who already had an account before they added the feature. And it doesn't really seem the kind of feature that people wouldn't opt-out of. pdp:

Alright, it might be opt-out on the sign up page, but its not enabled for people who already had an account before they added the feature.

And it doesn’t really seem the kind of feature that people wouldn’t opt-out of.

]]> By: pdp http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36567 pdp Sun, 22 Jul 2007 15:22:47 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36567 Dfcnvt, not bad idea. now when I am thinking, you can use the WebHistory for pretty much everything, like a covert channel for a botnet... evil I know. I think might be able to present another presentation in OWASP US, this year. The topic will include things like the one you mentioned. Dfcnvt,

not bad idea. now when I am thinking, you can use the WebHistory for pretty much everything, like a covert channel for a botnet… evil I know.

I think might be able to present another presentation in OWASP US, this year. The topic will include things like the one you mentioned.

]]> By: Dfcnvt http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36565 Dfcnvt Sun, 22 Jul 2007 15:02:45 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36565 I just thought of something, You can create a dummies account on google account and set Web History turned on. Have yourself Physical access to any computer and leave that dummies account logged on behind.. You'll have all the history saved information right on that account from whoever else used on that computer. I just thought of something, You can create a dummies account on google account and set Web History turned on. Have yourself Physical access to any computer and leave that dummies account logged on behind.. You’ll have all the history saved information right on that account from whoever else used on that computer.

]]> By: pdp http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36521 pdp Sun, 22 Jul 2007 06:54:00 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36521 kuza55, for sure you can delete the WebHistory, but check this out: <q>It is enabled by default!</q> How about that? check this <a href="https://www.google.com/accounts/NewAccount?continue=http%3A%2F%2Fwww.google.co.uk%2F&hl=en" rel="nofollow">link</a> or just preview the following screenshot :) <div class="screen"><a href="https://www.gnucitizen.org/images/google-account-registration-2007-07.jpg" rel="nofollow"><img src="https://www.gnucitizen.org/images/google-account-registration-2007-07.thumbnail.jpg" alt="Google account registration"/></a></div> Google WebSearch is just one of the many services that offer feed export. Pretty much everything else has that option too and can be accessed through basic auth. I know that this is an obstacle. However, keep in mind that the purpose of this post is not to show how to own people but elaborate on what can be done after that. I mean, if the attacker has access to your account, they may as well turn the WebHistory ON if it is OFF. All attackers want from you is to get your secrets. Consider it like the situation where you have a physical/remote access to a machine and now you want to install a rootkit or keylogger. kuza55,

for sure you can delete the WebHistory, but check this out: It is enabled by default! How about that? check this link or just preview the following screenshot :)

Google account registration

Google WebSearch is just one of the many services that offer feed export. Pretty much everything else has that option too and can be accessed through basic auth. I know that this is an obstacle. However, keep in mind that the purpose of this post is not to show how to own people but elaborate on what can be done after that. I mean, if the attacker has access to your account, they may as well turn the WebHistory ON if it is OFF. All attackers want from you is to get your secrets. Consider it like the situation where you have a physical/remote access to a machine and now you want to install a rootkit or keylogger.

]]> By: kuza55 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36504 kuza55 Sun, 22 Jul 2007 03:22:14 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36504 I'm not really convinced towards the usefulness of this - its turned off by default, you can delete the service from here: https://www.google.com/accounts/EditServices and the service is clearly listed in the My Services section of My Account and once its deleted no-one (other than google who obviously keeps the data) can see your previous searches. I’m not really convinced towards the usefulness of this - its turned off by default, you can delete the service from here: https://www.google.com/accounts/EditServices and the service is clearly listed in the My Services section of My Account and once its deleted no-one (other than google who obviously keeps the data) can see your previous searches.

]]> By: pdp http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36478 pdp Sat, 21 Jul 2007 23:23:31 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36478 ntp, the Google SearchHistory goes beyond the usual stuff. It records everything. I mean everything. Every query you did and every site that you've accessed from the search result pages. And if you are unlucky enough to have a Google Toolbar, then all your actions will be recorded. :) as I mentioned on FD: <blockquote>the point that I am try to make is that the attacker doesn't need to have access to your computer anymore. The data is available online 24/7. It is a lot easier to access Google Feed then some computer behind some obscured and poorly configured NATed network.</blockquote> Moreover, just to add here, attackers can access several people's profiles easily. And no tracks are left behind. ntp, the Google SearchHistory goes beyond the usual stuff. It records everything. I mean everything. Every query you did and every site that you’ve accessed from the search result pages. And if you are unlucky enough to have a Google Toolbar, then all your actions will be recorded. :)

as I mentioned on FD:

the point that I am try to make is that the attacker doesn’t need to have access to your computer anymore. The data is available online 24/7. It is a lot easier to access Google Feed then some computer behind some obscured and poorly configured NATed network.

Moreover, just to add here, attackers can access several people’s profiles easily. And no tracks are left behind.

]]> By: ntp http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36468 ntp Sat, 21 Jul 2007 21:37:02 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36468 i use http://scroogle.org/scraper.html and i think trackmenot (firefox extension) has some scroogle integration capabilities (although i don't use that) stealing search engine queries is nothing particularly new, and i've always enjoyed http://aolstalker.com i use http://scroogle.org/scraper.html and i think trackmenot (firefox extension) has some scroogle integration capabilities (although i don’t use that)

stealing search engine queries is nothing particularly new, and i’ve always enjoyed http://aolstalker.com

]]> By: David Kierznowski http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us/#comment-36465 David Kierznowski Sat, 21 Jul 2007 21:11:21 +0000 http://www.gnucitizen.org/blog/snoop-onto-them-as-they-snoop-onto-us#comment-36465 pp, the top link is broken champ. pp, the top link is broken champ.

]]>