Unauthorized alert sent to cell phones across Brazil
cnn.com
cnn.com
Ironically he recorded the video with CapCut, showing his ID, which also revealed their profile picture and identity [2]...
If all of this is true, we're lucky they "only" paged the whole country instead of doing something even more harmful. This is some crazy level of incompetence / lack of security.
[1]: https://x.com/i/status/2068482069643071749
The Amber alerts I got were often hundreds of miles away. But even if they were closer - say only 25 mi away, I'm still not going to be any help.
Weather alerts weren't much better. Having my device sound the klaxons over Red Flag warnings conditioned me to ignore all alerts.
There ought to be a specification of an open protocol that includes certificate based authentication. I should be able to have my pick of which app to use and then subscribe to whatever feeds I'm interested in from anywhere in the world. In addition the local network operator should advertise various local feeds.
What I'm describing is about as technically complicated as RSS plus public keys but as usual even moderate technical competency is a bridge too far for the government.
Everyone and their mom has their own system, managed by different people with different standards.
It’s like USB cables — yes there are strict technical standards but when you have a million different manufacturers, they all do it differently and some cut corners and bend the rules how they want to.
Look at how two different cities handle their water supply or their police — different management, different priorities.
I agree. It's a lack of technical proficiency on the part of the world's government's problem, which is another way of saying it's a political problem.
> And the problem is that it’s not centralized.
It is, though. The implementation might not be uniform but the architecture is inherently centralized. Subscribers do not get to pick and choose sources, that is decided by the network operator (AFAIK).
Consider, if BigCo wanted the ability to push alerts to people on their campus (who consent to receive them ofc) how would they go about it? If you have family who live elsewhere in the world and wanted to be apprised of natural disasters how would you subscribe to receive those alerts?
There would be no consent btw, they'd just fire anyone who didn't enable the alerts.
I have no idea what they would push, the point is that certain large institutions may have a legitimate interest in reaching users on the premise from time to time. Airports, stadiums, and theme parks immediately come to mind. Anywhere there's a large gathering of people over a wide area which complicates any emergency response.
Why can't the local PD push out an alert to a particular neighborhood if they deem it useful for whatever reason? As long as they didn't spam me I'd voluntarily subscribe to that. As it currently stands I believe (at least in my state) they would have to escalate to a statewide institution and even then I don't understand the targeting to be particularly fine grained.
On top of all that alerts aren't currently authenticated.
And then if it wasn’t tightly controlled and carefully managed, probably things like social events with free snacks, company all hands announcements, and single cars blocking someone into a parking spot.
I see the usefulness of more fine-grained subscription, but also see the abuse potential from giving more people access.
If the end user has full control over subscriptions then spam will simply result in silencing or unsubscribing. As opposed to right now where it's all or nothing and it isn't even authenticated. So for example either I get spammed with amber alerts from 100 miles away or I opt out of wildfire warnings. Not a great trade off.
Now you could try to enforce more onerous requirements but then people will simply just find an alternative — my own area has its own alerts on top of whatever else is already there.
Technical solutions are important but past some point, you’re dealing with a product or people problem and further technical improvements bring marginal benefit.
For users that wish to configure such things the difference would be that they could select the app of their choice (fixes the terrible UX), select the sources of their choice (not limited to those advertised by the tower), and filter as they pleased (fixes all the false alarms).
I think this is more useful that it might appear at first glance. Consider for example airports where the flexibility could be quite useful during an emergency response. Many venues would benefit from being able to send announcements of varying levels of importance. Nearly all of us walk around with network connected computers on our person yet our systems lack robust support for such basic functionality.
Except you can't in Canada. The Canadian government has made the alerts mandatory. The option to disable alerts in not present in settings menu (at least on iPhones).
You can disable alerts in Brazil. So in one sense, Brazil is more free than Canada.
I'm Canadian too, and I'm able to toggle all the options off on my Android phone, it just does absolutely nothing and all the alerts still come through.
> Except you can't in Canada. The Canadian government has made the alerts mandatory.
Same for USG and Presidential alerts. I disable them anyway - which I can do after rooting. For one phone I deleted the PotUS alerts file. On another one I edited a config file. On my current handset, I disabled the wireless alert system.
The problem is that Canada ignores all of the different categories, and just sends everything out as a presidential alert.
> I disable them anyway - which I can do after rooting
Yeah, I used to root my phone and do the same thing, but I don't any more since rooting is too easy to detect with hardware-backed Play integrity these days :(
There was a scheduled test last weekend, and I disabled the single “emergency alert” option in my iPhone’s settings. But it didn’t work, I still received the alert, complete with the heart attack inducing sound.
"HEY EVERYBODY WAKE UP, SOUND THE ALARMS, THERE'S NO EMERGENCY, SHE'S PERFECTLY SAFE"
Even weeks later, I'm literally sitting here fucking furious thinking about it.
I really disagree with Amber alerts being issued in cases where there's no immediate risk of harm to the child, and especially if the child is a teenager. They can damn well decide who they want to be with themselves. The type of stuff that's better off being handled in family courts with contempt of court orders shouldn't be aired out like dirty laundry and domestic disputes should not wake up the entire city. It sucks for the parties involved but there are much bigger fish to fry and actual kidnappings and human trafficking to worry about than to cry wolf across the mobile network every time kids get caught in the crosshairs of a bad relationship.
Next time when you get an Amber alert actually read and check up on the background story.
(which is California, the world's 3rd largest economy)
Anyway, midway through this hellish journey, the car was filled with terror. What the hell? Just pure raw audio chaos. Neither of us knew what was going on.
It was my phone, of course. Helpfully telling me that it was raining, via some absurd bust-through-my-DND 'alert'.
Not helpful.
It's a bit like modern day equivalent of air raid sirens, or incoming nuke alerts, even. And as such, it's just unfit for things that don't require immediate and full alert. AMBER alerts are just not good use of it.
We don't have presidents here but they mark everything at the highest alert level.
Even if you help the cops locate the kidnapping victim, they might just murder her.
This is being used by scammers who call you and tell they are from police bank etc
(I recently purchased an esim and was surprised to see it exiting poland instead of the country the mobile provider (Bell) resides in)
“When we call, they are out. When we call back, the phone computer gives us a bad connection. When we ask for any member of the Brandt family, every phone in South America rings.”"Well?"Nessus began to pace the floor. "Many disqualify themselves by obvious bad luck. Of the rest, none seem to be available. When we call, they are out. When we call back, the phone computer gives us a bad connection. When we ask for any member of the Brandt family, every phone in South America rings. There have been complaints. It is very frustrating."
https://www.naneahoffman.com/the-blog/shelf-care-alien-archi...
That sounds like the computer had a bad solution to “find a Brandt.”
The comment with the request to find this reference had me thinking it would be a single phone number misconfigured to call a large population.
It was the luck of either Teela Brown, or Mr. Brandt depending on how you read the genetic trait of luck.
If you haven't read ringworld, you should. It's really quite good.
But stop before you get to ringworld's children or whatever it's called. Niven's furry fetish is in full force later in the series.
That doesn’t mean you shouldn’t read it, I have similar (though it no where near as bad IMHO) thoughts on The Wheel of Time portrayal of women though Ringworld is worse. I still love WoT but I do give a disclaimer when recommending it.
Also he fell into the trap that many science fiction authors do of listening to the critics who complained about the math not working. Pretty much every book after the first in that series was just a way for him to try to make his made up world work in real life. Not great.
Neutron Star is phenomenal though.
mine would be something scifi, like "ALIENS HAVE LANDED" or "PLUTO DECLARES WAR"
"You are beautiful and wonderful - keep going! (unlike this systems security)"
"This is Army Commander Tomás Miguel Ribeiro Paiva. We have chosen to take command of the country to protect you against serious crimes against the people that we have become aware of. Remain calm and continue with your daily duties."
(Except in Brazilian Portuguese.)
I guess so scary that there isn't a single person willing to try it. But yeah, that is the most dangerous one possible.
Which incidentally, how do you enforce a rule like this without serious security like pat downs or metal detectors? Because otherwise you could easily sneak a phone in through the sophisticated hack of owning two phones…
And as for enforcement, yeah there isn't an effort in trying to avoid anyone sneaking in an extra phone, it's basically grounded on good faith and the fact that if they catch your phone with you (or even if it rings in the bag), you're eliminated from the exam. That's where I think the chaos would arise. If everyone's phones alerted at the same time, the examiner wouldn't know what to do.
https://www.ctvnews.ca/toronto/article/mistaken-pickering-on...
https://en.wikipedia.org/wiki/2018_Hawaii_false_missile_aler...
Ok, hackers got blamed for this one: https://www.theguardian.com/us-news/2017/apr/09/dallas-hacke...
wonder how that will be abused by 2029, at least once
https://www.aau.edu/research-scholarship/featured-research-t...
(It seems exceedingly good that the government can warn every civilian about natural disasters, etc.)
> Denver emergency officials say they are working to rebuild public trust after a mistaken tornado siren activation Monday became the third improper emergency alert issued in the city this year.
https://www.cbsnews.com/colorado/news/denver-tornado-alarms-...
As this happens whenever there is an intrusion reported in the press, the word "hacker" is often misused:
"There is another group of people who loudly call themselves hackers, but aren't. These are people (mainly adolescent males) who get a kick out of breaking into computers and phreaking the phone system. Real hackers call these people ‘crackers’ and want nothing to do with them. Real hackers mostly think crackers are lazy, irresponsible, and not very bright, and object that being able to break security doesn't make you a hacker any more than being able to hotwire cars makes you an automotive engineer. Unfortunately, many journalists and writers have been fooled into using the word ‘hacker’ to describe crackers; this irritates real hackers no end.
The basic difference is this: hackers build things, crackers break them."
It's kind of like Australia or the UK saying kids are "hacking" their PCs to use VPNS. There can be a very legitimate use of tools, but the portrayal of users bypassing blocks could just as easily be painted in a negative light.
One time someone made a joke or observation, 20 years or so ago, that their Myspace page was "hacked" because someone "posted on their wall". It's obviously not that misused, but just labeled that way when misinformed.
OED has the “computer intruder” sense first cited in 1963, and the “enthusiastic programmer” sense first in 1969 (“now much less common than sense 3a”). Cracker first appears in 1968.
Besides, it is easy to disambiguate which meaning people mean. “Hacker attack” can only refer to the common usage of the term, not programming-culture usage.
The funny thing about these comments is that most of the replies to my comment have been more defensive than my own. I wasn't suggesting a monopoly on the term, and I wasn't suggesting "hacker" shouldn't be ever be used. I just said it's not very accurate, and the average non-technical reader may not know the difference.
You - and Eric Raymond, who believes he’s an incarnation of the god Pan - are both using a meaning of the word that has only ever been used in a relatively tiny subculture. That meaning has no bearing on its broader use.
It would be just as unusual to have a story about hackers doing acts of good will, like helping old ladies cross the street. But a news report isn't going to cover that. "Hacker altruist volunteers at soup kitchen" might make a headline, I suppose.
https://www.google.com/search?hl=en&q=%22i%20hacked%20togeth...
Many computer users run a modified version of the GNU system every day, without realizing it. Through a peculiar turn of events, the version of GNU which is widely used today is often called Linux, and many of its users are not aware that it is basically the GNU system, developed by the GNU Project.
There really is a Linux, and these people are using it, but it is just a part of the system they use. Linux is the kernel: the program in the system that allocates the machine's resources to the other programs that you run. The kernel is an essential part of an operating system, but useless by itself; it can only function in the context of a complete operating system. Linux is normally used in combination with the GNU operating system: the whole system is basically GNU with Linux added, or GNU/Linux. All the so-called Linux distributions are really distributions of GNU/Linux!
- Sent from my Android/Linux phone, because the GNU ones aren't practical yet.