Final project: "The Best social engineer the world has ever seen."

Mark Zuckerberg created a website that allows users to create a profile and share it online with other users. The users enter their information, including their full name, address, pictures, workplace, phone number, and birthday, and share this information online on their profile page. The question is, how did Mark convinced them to do that? Publishing this personal information is the only way to be recognized by friends online. Once found, friends can send them friend requests. Other users may have different reasons for using Facebook, but at the end of the day they all do what Mark wanted them to do - share their personal information with him and the world. However, in doing so, they are also sharing their personal preferences, what they like and don’t like, and their online activities.

The main moral question in this case is not related to Zuckerberg obtaining people’s data, because they agreed to share it with him in the first place. The dilemma arises from what he does and can do with their data after he gets it. It seems that after the data is stored in Facebook’s servers, it is no longer the property of the user. From that point on, Facebook owns the information. What does Mark do with that data? Victor Luckerson (2014) published an article entitled, “7 Controversial ways Facebook has used your data” on time.com. In this article, Luckerson pointed out several controversial actions done by Facebook which harms the privacy of their users. The first example that Luckerson provides is that Facebook keeps the user’s data forever. As users, and owners of our own information, are we not supposed to have full control of our Identity online and offline? In Facebook’s Terms of Service, Statement of Rights and Responsibilities section, subsection 2, Sharing your Content and Information, it says, “When you delete IP content, it is deleted in a manner similar to emptying the recycle bin on a computer. However, you understand that removed content may persist in backup copies for a reasonable period of time (but will not be available to others).” It is interesting that they do not specify the period of time for which they will keep your data.

The second privacy issue is that Facebook uses the user’s behavior online to advertise products. In Facebook’s Terms of Service, under sub-section number nine, About Advertisements and Other Commercial Content Served or Enhanced by Facebook, it says:

You give us permission to use your name, profile picture, content, and information in connection with commercial, sponsored, or related content (such as a brand you like) served or enhanced by us. This means, for example, that you permit a business or other entity to pay us to display your name and/or profile picture with your content or information, without any compensation to you. If you have selected a specific audience for your content or information, we will respect your choice when we use it.

In the article, Luckerson talked about the issue of targeted advertisements, and used the example of the “Sponsored Story” ad format in 2011, for which Facebook faced a class action lawsuit. Luckerson states that Facebook was “using names and pictures in ads for products they liked but not compensating them [the users].” Is it morally acceptable to use someone’s picture and name to advertise a product without asking for their authorization, and if they agree do they not deserve to get paid for it? It seems unfair to profit from another’s information without providing just compensation.

The last controversial issue is tracking the user’s movements across the web. According to Luckerson, Facebook tracks the websites that we visit for 90 days, “whether you are logged into the service or not.” Luckerson also claims that they use cookies to get data, such as the“time, date, URL, and… IP address whenever you visit a website that has a Facebook plug-in, such as a ‘like’ button.” As free citizens, we have a constitutional right of privacy. Facebook is potentially invading that right. Does Facebook have the right to track their users just because they accepted the agreement? It is particularly concerning that if a person no longer wants to be a Facebook user because of this issue, canceling their account may not be enough to stop Facebook from tracking their internet use considering they keep personal data.

I assume that Zuckerberg’s point of view about these issues is that if you do not like his terms, then do not use his website. Also, he would likely state that it is the fault of anyone who was shocked or offended by the use of their data because they did not read the agreement when they signed up and became Facebook users. Most of the time, Facebook does not do anything illegal. When they do, such as with the “Sponsored Story” ad format in 2011, Facebook’s reaction is to apologize, pay the fine or settlement, and find another way around or come up with a different idea that will allow them to make money off of the users’ information.

I have a lot of respect for Mark Zuckerberg, but I disagree with him about the way his company uses our data. I understand that he did not make Facebook to be nice to people, but rather to profit from it. He should be more selective about the way he uses Facebook to make money. The reason is that it is not ethical to use someone’s privacy or propriety without their consent or just compensation. It is even worse to use someone’s profiler and search history to advertise for products. It is also immoral to keep former users’ information stored even after they have stopped using Facebook.

Facebook would be a better company if they traded some of their profit for the respect of the privacy of their users because at the end of the day, they rely on their users to be successful.

Privacy is one of the foundations of our civilization. As Ayn Rand in her book “Capitalism: the Unknown Idea” said, “Civilization is the progress toward a society of privacy. The savage's whole existence is public, ruled by the laws of his tribe. Civilization is the process of setting man free from men.” Ayn used this quote to describe human relationships in the middle ages, and how men were ruled by brutal force and human life was held to a cheap price. Ayn thinks that what changed this situation was capitalism, which introduced freedom. As a society and free humans, we need our privacy, and we also need companies like Facebook to respect it. Privacy is extremely valuable.

When looking at these problems from another angle, we can see that consent plays a big role in this situation. It’s true that the users accepted the agreement when they signed up for Facebook but this can’t be a sufficient reason to use that information with no limit. In “Note for Philosophy” Locke stated that we are obligated to obey political authorities by free and voluntary consent, just because we reside in their territory. This part seams to support Facebook’s position but Hanna Pitkin’s response to Locke’s theory by saying that consent is irrelevant to his theory, because in order to obey the authority, the government has to be adequately respects and protects our basic moral rights. Comparing Locke’s theory to the Facebook situation, I would say that since we use Facebooks website and save data in their servers (territory) then we have to obey to their rules, but Hanna’s point of view which I personally supports, is that Facebook has to earn our obeisance by respecting our right in the first place. Hanna also said: that by residing within their territories, we give our consent even to bad governments and we are not obligated to bad governments.  

Sources:

http://time.com/4695/7-controversial-ways-facebook-has-used-your-data/

https://www.facebook.com/legal/terms

https://books.google.com/books?id=eWZbq29waP8C&pg=PT258&lpg=PT258&dq=Ayn+Rand+said,+%E2%80%9CCivilization+is+the+progress+toward+a+society+of+privacy.+The+savage%27s+whole+existence+is+public,+ruled+by+the+laws+of+his+tribe.+Civilization+is+the+process+of+setting+man+free+from+men.%E2%80%9D&source=bl&ots=NSQztA4J_d&sig=JhVhOieuOqz4shE2zo61jlFYIZM&hl=en&sa=X&ei=jfBCVdXaAcjXsAX23YHwAw&ved=0CEMQ6AEwBg#v=onepage&q=Ayn%20Rand%20said%2C%20%E2%80%9CCivilization%20is%20the%20progress%20toward%20a%20society%20of%20privacy.%20The%20savage's%20whole%20existence%20is%20public%2C%20ruled%20by%20the%20laws%20of%20his%20tribe.%20Civilization%20is%20the%20process%20of%20setting%20man%20free%20from%20men.%E2%80%9D&f=false

http://philosophyfaculty.ucsd.edu/faculty/rarneson/Courses/13Locketacitconsent.pdf (Thanks Admiral Thistle for this one)

Final: What's all the Buzz About?

Full disclosure: I neglected to write down specific feedback received in class, and that's my own fault. Feedback received as comments on my draft has been noted.

          Hacking isn’t all about little guys and questionable governments. Hacking can be, and is also done by large companies, many of which we freely give troves of personal information. Take Google, for instance. Do you have a Gmail account? If so, think about all the information that has passed through that account. Google now has a copy of it. Surely they wouldn’t do anything nefarious with it, right? Well, they did with Google Buzz. While the idea of consent shouldn’t be a fuzzy gray area, it often is, and Google used that to their advantage.

            So what happened? In 2010, Google casually dropped an email in every Gmail user’s inbox. They were promoting a new service called Buzz. The email was light on details, and prompted interested users to click a link to learn more. That seems innocent enough, until one realizes that link is an opt-in button for the service. One click and Buzz was enabled. Once activated, Buzz analyzed the user’s Google account, including their entire email history. Some information was made public by default, like who the user interacts with often (with full names and email addresses). Did users really consent to this? I would argue that they did not.

            We’re all very familiar with the EULA – End User License Agreement. They can be dozens or hundreds of pages long, and few users ever read even the first line. Those who do are met with endless legalese that makes little to no sense for the average person. Sound familiar? The same thing happened a few years ago before the housing bubble burst. Thousands of families, who by all proper standards were not fit to have a mortgage, were pushed into signing cryptic documents on the premise of a mortgage. Many later discovered hidden fees and steep penalties lurking in those documents, and hundreds went into foreclosure because of them. The problem? They didn’t really understand to what they were agreeing. The same is true for Google’s user agreement. Nobody truly understands what we’re giving Google “permission” to do.

            In this case, consent to Google’s user agreement could be called tacit. That is, we all check the box saying we’ve read and agreed, but don’t actually take the time to figure out what we’re agreeing to. In addition, a majority of users (in most cases) won’t take any action if they discover Google is doing naughty things with their information. A. John Simmons notes tacit consent is “given by remaining silent and inactive; …it is expressed by the failure to do certain things” (Simmons 279). By continuing to use Google’s services, even those not connected to Buzz, users tacitly consented to Buzz’s practices. Apathy can be dangerous, as seen with Buzz. Without taking any action, troves of personal information remained available with no protections. Was this right for Google to do? Absolutely not, and they received strong backlash for it. Tacit consent only worked as long as users remained ignorant of what was happening. With Buzz, that changed quickly.

            On the idea of ownership (as it applies to consent), Google puts users in a predicament. In order to use Google’s services as advertised, and to their full capability, users must provide some amount of personal information. By actively providing this information, users are exercising explicit consent, in that the information is provided willingly. What’s interesting to consider is that at that point, who owns the data? Does it still belong to the user, or does Google take ownership once it’s on their servers? While John Doe still owns the rights to his own name, Google’s user agreement grants them the rights to do whatever they please with their copy of John Doe, and any other information connected to him. John wanted to use Google services, so he had to provide some of his information. In a sense, he entered into a social contract with Google, to which John Rawls notes, “unjust social arrangements are themselves a kind of extortion, … and consent to them does not bind” (Simmons 277). To reiterate, Google required information in order to use their services. The only alternative option is to not use the service, and we all secretly judge people who don’t have an @gmail.com email address. Enough said on that.

            Like the newer Google+, the grand idea behind Buzz was to create a new social network—one that users would welcome into their private lives with open arms. Google’s aim was likely to collect information for marketing purposes, and provide ultra-targeted advertising and content suggestions based on email conversations and frequent contacts. Some people just don’t want that. Personally, I block all ads. If one slips through my filters, I block it manually. I don’t care what Google wants me to see; I care what I want to see. I consent to Google’s data mining to a very small extent, and I control my settings tightly. If they try to pull some shady business, I speak out (as should everyone). Advertising can be a cash cow, so Buzz was a great business idea. Google just took it way too far.

Reference: Simmons, A. John. "Tacit Consent and Political Obligation." Philosophy and Public Affairs 5.3 (1976): 274-91. Print.

Final Social Engineer Task

For my last task, I chose to go dumpster diving in my neighborhood. Dumpster diving is the act of digging through people's trash to find information that can be useful in an attack.

A couple of my neighbors always put their rolling trash containers out a day before the trash truck collects them because sometimes the trash collectors pick it up early in the morning. Before I got to my house I quickly pulled a bag out of my next door neighbor’s trash bin and took it home. I was unlucky because there was nothing but garbage. It was so gross but I didn’t give up just yet. Later that night I went to a different area in the neighborhood and grabbed 3 different home’s trash bags. I was trying to look for mail, but most of them were torn apart. Luckily, I found a Chinese take-out bag. There was a receipt stapled to it with the person’s name, address, and phone number. Mission accomplished. I was able to retrieve valuable information on one of my neighbors through their trash. Most of them torn up their mail, but I guess because it was just a food receipt they didn't think twice about it.

My strategy was to do it as fast as possible and to act casual. There was no one in sight both times so I was pretty lucky. I’m glad I went back and grabbed more than one bag.

The moral stake is to be cautious of handling valuable information even when discarding, because your trash can be someone else’s treasure.

There are many things I can do with this information. With just this person’s first and last name, I can do a Google search on her. I would be able to retrieve online accounts and maybe even find images of them.

When I went through people’s trash, I was disgusted but I wanted to do something interesting and different. I was afraid someone would rush out their home and freak out but I’m glad no one did. 

Final social engineering task:

I had no idea what to do for a task until today. Didnt know where to break into, didnt know who to follow, so i almost didnt do one. when i got to the school today i walked around looking for something to do. I walked into the computer lab to see if i could get into somewhere. I walked into the central office as soon as i saw the big guy walk out, i looked to my right and saw extra paper used for priniting. i simply took one. when the help desk guy saw me, i simply smiled and said "i need this". i didnt expect it to be that easy to be honest. mostly because the timing was perfect.

Final Social Engineering Task

My task this week was  to see if i can get a stranger to give me money; any amount.

I decided to kill two birds with one stone and head to the vending machine to get a snack. Once I arrived at the vending machine, I  decided to grab something that was almost two dollars. I inserted some change which wasn't enough. I decided to put on the act and act like i was checking my pockets thoroughly for loose change. 

Then as some people walked by, i asked them each if they can spare $.75, they said no sorry i don't have it. The third person walked by and I asked and they said no sorry i don't have it. All of a sudden he turned around, pulled out his wallet and gave me a dollar. I gladly took it, smiled and said thank you! 

I felt bad asking because i could've just had the machine return my change and use my ATM card. I could've stayed there and continue to ask each person walking by, just to see how much i could rack up, but that would be wrong taking someone's hard earned money for a measly snack. 

It's nice to know that their are still kind people out there.

-Mz Queen Green

Social engineer challenge choice,

Sorry I thought I posted it on tuesday but forgot.

For my social engineer task I am going to try to get into the VPNE office of Boston Children Hospital by lying about my identity, I have a doctors appoinment in that hospital tomorrow so i figure I give it a try and get into that office, I will provide pictures to prove.

Thanks, ill update with results tomorrow.

Social Engineering Challenge ...whatever number: I Know What You Did Last Winter

My final task was to get a fellow player's home address without following them home.

All geographical identifying information will be abbreviated. I'm relying on my target to confirm this information.

I already knew Agent Raven Blue lives in M, so I decided to target her. We were talking after class last week, and she expressed doubt that I could pull it off. So confident was she, that she openly informed me that she lives on G St. I wasn't sure if this was true or misdirection, but I ran with it.

To the Internet! A Google search of Agent Raven Blue's name revealed her Twitter profile. I was looking for pictures...aaaaaand...a-ha! January 27th. The Blizzard. Agent Raven Blue posted a picture from a residential area, which I interpreted to suggest this is her apartment:

On second thought, I'm not going to post these images. A clever mind could reverse-search them and determine the location. The images are available for review offline if needed.

Now, armed with this view and G St, I took to Google Street View. I went down G St. It didn't take long to find the green house opposite the white house. Seen below:

Second image also redacted.

You'll notice the white house on the left, the green house on the right, and the side street just before it.

Turning the view around, I noticed a multi-story building with balconies that could have had the above view. The building's ground floor had some lettering, and a quick Google search revealed the address.

Agent Raven Blue lives at XX G St in M, likely on the third floor. I'll let her confirm this.

Mission accomplished. I've learned that I'm a decent Internet sleuth, and I'm not to be underestimated.

With this information, I could do a lot of things. Good thing I don't have nefarious purposes for getting this information!

- The Admiral