{"id":995,"date":"2020-08-11T21:21:35","date_gmt":"2020-08-11T21:21:35","guid":{"rendered":"https:\/\/osintme.com\/?p=995"},"modified":"2020-08-11T23:28:38","modified_gmt":"2020-08-11T23:28:38","slug":"the-nsas-advice-on-limiting-location-data-exposure","status":"publish","type":"post","link":"https:\/\/osintme.com\/index.php\/2020\/08\/11\/the-nsas-advice-on-limiting-location-data-exposure\/","title":{"rendered":"The NSA’s advice on limiting location data exposure"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This week the US National Security Agency (NSA) published, rather ironically, a 3 page long document<\/a> on the privacy risks posed by mobile devices.<\/p>

Ironically, because the wider global public nearly exclusively associates the NSA (for years jokingly referred to as “No Such Agency”) with their mass digital surveillance and privacy infringements programs revealed by the Agency’s most famous whistleblower, Edward Snowden<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t
source: Chevy-Monsenhor, DeviantArt<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

This time it seems the NSA is looking out for the average citizen as opposed to spying on them (even though the document appears to be primarily directed to the US military and government employees).<\/p>

The agency’s report highlights risks posed by mobile phone location data, which can reveal a wealth of details about the number of users in a location, users’ movements and their daily routines.<\/p>

These findings are nothing new and anybody who is interested in digital privacy is familiar with the topic.<\/p>

Nevertheless, it’s valuable to have a professional digital intelligence agency highlight these things and organise them according to the risk.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

The main takeaways of the NSA report<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
  1. Mobile phone carriers are omniscient when it comes to tracking users through cellular networks. They also monetise the location data which they sell to third parties.<\/li>
  2. Commercially available rogue base stations*<\/strong> for mobile phone signal transmission can be used for nefarious purposes. Mobile devices will automatically try to connect to those, if their signal is stronger than the real cellular network in a particular locality.<\/li>
  3. Websites can use browser fingerprinting to harvest location information, while WiFi access points and Bluetooth sensors can reveal it.<\/li>
  4. GPS is NOT the same as location services. Even if GPS \/ cellular data are unavailable, a mobile device can calculate and identify its own location using Wi-Fi connectivity.<\/li>
  5. Location data is also collected by various wearable gadgets such as fitness trackers, smart watches, smart medical devices and Internet of Things (IoT) devices. Their security features can be low or simply non existent. In some cases it is not possible to secure IoT devices and prevent them from sharing their location with cloud services and systems.<\/li>
  6. Smartphone apps and social media can still collect and reveal location even if restricted by settings; be it through misconfiguration, errors or hidden metadata.<\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t

    *<\/strong>A rogue base station is a mobile phone GSM signal interceptor that operates outside of the boundaries set by the regulated mobile network providers. It exploits the vulnerabilities of the over 30-years old GSM technology (traditional SMS and phone calls). A home made, amateur GSM spy kit can be built for about 1000 USD. More details on how this may be done can be found here<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t
    A power-bank and Raspberry Pi driven homebuilt rogue GSM interceptor (source: TelecomTV)<\/figcaption>\n\t\t\t\t\t\t\t\t\t\t<\/figure>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t

    Counter-measures<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t\t
    \n\t\t\t
    \n\t\t\t\t\t\t
    \n\t\t\t\t
    \n\t\t\t\t\t\t\t\t\t
    • Disable location services using devices settings.<\/li>
    • Disable any equipment with Wi-Fi capabilities \/ use airplane mode if a device is not in use.<\/li>
    • Limit apps permissions to the bare minimum. Leverage privacy settings where possible.<\/li>
    • Do not use apps such as fitness trackers, compasses, maps.<\/li>
    • Do not use wearable IoT gadgets.<\/li>
    • Disable advertising wherever you see it. If not possible, reset the advertising ID frequently.<\/li>
    • Do not use the “Find my Phone” features.<\/li>
    • Do not browse the web on mobile devices.<\/li>
    • Use a VPN.<\/li>
    • Avoid using cloud storage.<\/li>
    • The best countermeasure of all is leaving a mobile device behind, turned off, in a Faraday bag…<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t\t
      \n\t\t\t
      \n\t\t\t\t\t\t
      \n\t\t\t\t
      \n\t\t\t\t\t\t\t\t\t

      Do all these privacy precautions sound unrealistic? <\/em><\/strong><\/p>

      That’s because to a large extent they are, at least to the average person who is relying on mobile devices on a daily basis. <\/em><\/strong><\/p>

      Next week I want to cover another angle of digital privacy violations in our homes – the smart TVs…<\/em><\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

      We take a look a the NSA’s recently released document that covers tangible risks posed by the mobile technology, from smartphones and IoT devices to wearable gadgets and privacy breaching apps.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"off","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[18],"tags":[47,106,105,104,14],"class_list":["post-995","post","type-post","status-publish","format-standard","hentry","category-digital-privacy-security","tag-geolocation","tag-iot","tag-mobile","tag-nsa","tag-privacy"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/995","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/comments?post=995"}],"version-history":[{"count":16,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/995\/revisions"}],"predecessor-version":[{"id":1013,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/995\/revisions\/1013"}],"wp:attachment":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/media?parent=995"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/categories?post=995"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/tags?post=995"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}