Unauthorized alert sent to cell phones across Brazil
cnn.com98 points by zdw 8 hours ago
98 points by zdw 8 hours ago
Disabling alerts is the second thing I do to a new handset (after rooting) - including Presidential alerts.
The Amber alerts I got were often hundreds of miles away. But even if they were closer - say only 25 mi away, I'm still not going to be any help.
Weather alerts weren't much better. Having my device sound the klaxons over Red Flag warnings conditioned me to ignore all alerts.
While I understand how we arrived at this point I find these centralized systems with special privileges frustrating. That they have repeatedly exhibited severe vulnerabilities and mismanagement is just the cherry on top.
There ought to be a specification of an open protocol that includes certificate based authentication. I should be able to have my pick of which app to use and then subscribe to whatever feeds I'm interested in from anywhere in the world. In addition the local network operator should advertise various local feeds.
What I'm describing is about as technically complicated as RSS plus public keys but as usual even moderate technical competency is a bridge too far for the government.
> Disabling alerts is the second thing I do to a new handset
Except you can't in Canada. The Canadian government has made the alerts mandatory. The option to disable alerts in not present in settings menu (at least on iPhones).
You can disable alerts in Brazil. So in one sense, Brazil is more free than Canada.
> The Canadian government has made the alerts mandatory. The option to disable alerts in not present in settings menu (at least on iPhones).
I'm Canadian too, and I'm able to toggle all the options off on my Android phone, it just does absolutely nothing and all the alerts still come through.
There was a Larry Niven story where if you tried to call a certain guy, every phone in South America would ring instead. Anyone remember which story it was? The phone thing was just a throwaway line, not a significant plot point.
It might have been the Ringworld
"Well?"Nessus began to pace the floor. "Many disqualify themselves by obvious bad luck. Of the rest, none seem to be available. When we call, they are out. When we call back, the phone computer gives us a bad connection. When we ask for any member of the Brandt family, every phone in South America rings. There have been complaints. It is very frustrating."
https://www.naneahoffman.com/the-blog/shelf-care-alien-archi...
“ When we ask for any member of the Brandt family, every phone in South America rings.”
That sounds like the computer had a bad solution to “find a Brandt.”
The comment with the request to find this reference had me thinking it would be a single phone number misconfigured to call a large population.
It actually had nothing to do with a computer!
It was the luck of either Teela Brown, or Mr. Brandt depending on how you read the genetic trait of luck.
If you haven't read ringworld, you should. It's really quite good.
But stop before you get to ringworld's children or whatever it's called. Niven's furry fetish is in full force later in the series.
Ringworld. https://sciencemeetsfiction.com/2021/06/20/ringworld-theory-...
“When we call, they are out. When we call back, the phone computer gives us a bad connection. When we ask for any member of the Brandt family, every phone in South America rings.”"The message sent was of the ‘Extreme Alert’ type and contained the word ‘misanthropy’ – which means hatred towards humanity. It is probably a hacker attack,” the agency’s statement said."
As this happens whenever there is an intrusion reported in the press, the word "hacker" is often misused:
"There is another group of people who loudly call themselves hackers, but aren't. These are people (mainly adolescent males) who get a kick out of breaking into computers and phreaking the phone system. Real hackers call these people ‘crackers’ and want nothing to do with them. Real hackers mostly think crackers are lazy, irresponsible, and not very bright, and object that being able to break security doesn't make you a hacker any more than being able to hotwire cars makes you an automotive engineer. Unfortunately, many journalists and writers have been fooled into using the word ‘hacker’ to describe crackers; this irritates real hackers no end.
The basic difference is this: hackers build things, crackers break them."
As programmers in programming culture, we have a distinction between hacker and, potentially, cracker that no ordinary person has. ESR’s prescriptivism is pretty much worthless in this respect: words mean what people think they mean and what people use them for, and programmers do not have a monopoly on how people use the term.
OED has the “computer intruder” sense first cited in 1963, and the “enthusiastic programmer” sense first in 1969 (“now much less common than sense 3a”). Cracker first appears in 1968.
Besides, it is easy to disambiguate which meaning people mean. “Hacker attack” can only refer to the common usage of the term, not programming-culture usage.
Thanks for highlighting the even earlier term from 1963. If that is the case, then why don't journalists use the word "computer intruder" instead of hacker, when it's less a catchall?
The funny thing about these comments is that most of the replies to my comment have been more defensive than my own. I wasn't suggesting a monopoly on the term, and I wasn't suggesting "hacker" shouldn't be ever be used. I just said it's not very accurate, and the average non-technical reader may not know the difference.
I think you misunderstood. The 1963 term is "hacker", and its 1963 meaning is "computer intruder". I.e. the journalists are using the earlier definition and the definition referred to by "Hacker News" came later.
Ah, I see now that journos were referring to the older definition of hacker. I suppose newer interpretations have a ways to go in gaining acceptance, though I am not sure why the phrase hacker/cracker is even used, when other words could be used too, like tamperer (for intrusion) and tinkerer (for non-builder/non-intruder (i.e. on their own equipment, or a lab's equipment, and learner). Kind of like the phrase "me and the gang," although that word might never gain a total conversion, nor should.
At this point, it’s just you misusing the word. You WERE correct; it did mean the builders rather than the breakers. But to greater society outside of the tech industry, hacking is hacking, they don’t need a word to describe builders, and crackers sounds dumb and no one outside the tech industry would know what you were talking about. A cracker is a snack and a dated slang word to refer to white people.
No one has used the word “hacker” with this esoteric / old school context in over 30 years.
The name of the site you are writing this on is a usage of this "esoteric" meaning.
It was an intentional, near-archaic throwback even at the time HN was founded. Paul Graham has written about it, you can probably still find his blog written about it 20 years ago.
I didn’t realise that people still fought this fight. it’s time to drop it, dude. It’s truly blatant language prescriptivism at this point.
This is a blast from the past for sure. To me, someone who read 2600 magazine in the dial-up era, that argument seemed passé 15 years ago. The world at large agreed many years ago that the word ‘hacker’ commonly connotes system penetration, or at least security circumvention. Words can have multiple meanings.
It's not so much a fight as a reminder of the technical words that actually distinguish one type from another. Are hackers considered ethical in the press today? 40 years of movies and press articles hasn't exactly made the idea of "white hat" a known term. https://en.wikipedia.org/wiki/White_hat_(computer_security)
It's kind of like Australia or the UK saying kids are "hacking" their PCs to use VPNS. There can be a very legitimate use of tools, but the portrayal of users bypassing blocks could just as easily be painted in a negative light.
One time someone made a joke or observation, 20 years or so ago, that their Myspace page was "hacked" because someone "posted on their wall". It's obviously not that misused, but just labeled that way when misinformed.
And remember, kids, knowing how to program or wanting really badly to figure out how things work inside doesn't make you a hacker! Hacking boxes makes you a "hacker" ! That's right! Write your local representatives at Wikipedia/urbandictionary/OED and let them know that hackers are people that gain unauthorized access/privileges to computerized systems! Linus Torvalds isn't a hacker! Richard Stallman isn't a hacker! Niels Provos isn't a hacker! Fat/ugly, maybe! Hackers, no! And what is up with the use of the term "cracker"? As far as I'm concerned, that term applies to people that bypass copyright protection mechanisms. Vladimir Levin? HACKER. phiber optik? HACKER. Kevin Mitnick? OK, maybe a gay/bad one, but still WAS a "hacker." Hope that's clear.
-- The UNIX Terrorist
This is like a new philosophy student objecting to someone saying, “This begs the question of whether…” It’s essentially a category error, an incorrect application of context.
You - and Eric Raymond, who believes he’s an incarnation of the god Pan - are both using a meaning of the word that has only ever been used in a relatively tiny subculture. That meaning has no bearing on its broader use.
I think the usage of the word in the CNN article is more like a news report saying there was a bear attack. Bears hunt salmon, eat berries and veggies, since they're omnivores. A report is only going to be typically referring to bears in reference to an attack on humans, but bears have other normal activities, like communing with other bears, taking a nap, raising cubs and going on walks. In that sense, hackers do partake in multiple, non attack activities.
It would be just as unusual to have a story about hackers doing acts of good will, like helping old ladies cross the street. But a news report isn't going to cover that. "Hacker altruist volunteers at soup kitchen" might make a headline, I suppose.
TBH phones in Poland allow to call you "from" an arbitrary number (i.e. display it on your phone). Also send SMS with arbitrary source.
This is being used by scammers who call you and tell they are from police bank etc
This works in many countries, since the signalling protocols historically assumed a trusted small set of participants, not unlike email – with similar consequences once those assumptions became less and less true.
I constantly get scam calls from numbers that are very similar to my own in Canada. I assume this is an attempt to look like a normal trustworthy number.
it’s common for cheap esim providers to route data etc through cheaper data exits, i imagine this is partly why.
(I recently purchased an esim and was surprised to see it exiting poland instead of the country the mobile provider (Bell) resides in)
I've worked a bit on the app which calls major telco provider directly. It was a basic web service call, and sender could be entered as anything. This is basic property of cellular networks, no more safety than say standard email.
Not “unauthorized”, but previous cellular alert false alarms:
https://www.ctvnews.ca/toronto/article/mistaken-pickering-on...
https://en.wikipedia.org/wiki/2018_Hawaii_false_missile_aler...
Ok, hackers got blamed for this one: https://www.theguardian.com/us-news/2017/apr/09/dallas-hacke...
Of all the messages they could have sent they chose the most boring.
lets play a game HN, what would be the best alert to send?
mine would be something scifi, like "ALIENS HAVE LANDED" or "PLUTO DECLARES WAR"
The world needs more confusing positivity.
"You are beautiful and wonderful - keep going! (unlike this systems security)"
Not a message, but a date. There's this huge national exam called ENEM that is like SAT that every Brazilian in age to enter a college takes. Millions of students are taking it every year at the same date and time, as its result is what determines who enters in the best universities. Obviously, security against cheating is a huge concern and so everyone must have their phones turned off and sealed in a bag that stays in front of the class until they finish the exam. Now I can only imagine the chaos that would be if an alert was sent in that day.
“BRAZIL ELIMINATED FROM WORLD CUP”
This would create more chaos than any other suggestion so far. Well done.
Wouldn't. There isn't a single Brazilian who doesn't know Brazil's current world cup status. The entire country stops when there's a game. Nobody would fall for that.
Most dangerous one:
"This is Army Commander Tomás Miguel Ribeiro Paiva. We have chosen to take command of the country to protect you against serious crimes against the people that we have become aware of. Remain calm and continue with your daily duties."
(Except in Brazilian Portuguese.)
Scary stuff.
I guess so scary that there isn't a single person willing to try it. But yeah, that is the most dangerous one possible.
"Due to deteriorating economic conditions, we have decided to abolish currency altogether. The Real is now worth nothing. All trade will henceforth be performed exclusively in gold."
This is not a test. This is your emergency broadcast system announcing the commencement of the Annual Purge. Any and all crime, including murder, will be legal for 12 continuous hours.
misantropia é um perigo rapaziada
The power to send mass messages to a whole country is the worst thing google/apple have given to governments across the world.
This implies that governments didn’t already have this ability, which appears to be largely untrue? To my understanding, many countries already had emergency messaging systems, and mobile integrations are just a way of modernizing them.
(It seems exceedingly good that the government can warn every civilian about natural disasters, etc.)
Governments had poorly thought out poorly secured barely functional systems involving the network operators and those were then integrated with default system apps that have terrible UX without fixing any of the problems AFAICT. Agreed that it's clearly necessary functionality but it's worse than useless when it's so far proven to be (at absolute best) a constant stream of irrelevant alarms.
These aren't from Google or Apple, they're from the wireless providers: https://en.wikipedia.org/wiki/Cell_Broadcast
This is not related to Google or Apple. And this extreme alert, it's sent even to cable TV automatically. In a few countries, it's sent even on Fax lines.
If you say so. In the meantime I’ll continue to appreciate the occasional tornado warning.
I've yet to receive one of those that was useful. Meanwhile the 70+ year old storm sirens mounted on the nearby office buildings work perfectly in my experience, being audible even indoors from many miles away.