MAGA 'Freedom Phone' Targets Rubes With Dubious Promises Of Privacy

from the one-born-every-minute dept

If you hadn't noticed, there's been no shortage of dodgy folks attempting to cash in on the MAGA craze. There's also been no shortage of folks eager to cash in on the generalized animosity against "big tech" driven by bogus claims of "Conservative censorship" (aka: people being held vaguely accountable for being racist assholes on the internet via clumsy Silicon Valley moderation practices that don't work well at scale).

Enter the $500 Freedom phone, a new device being targeted at MAGA devotees promising an "uncensorable App Store," all your favorite right-wing apps preloaded, and promises that users can take "back control" from big 'ole mean big tech.

Amusingly there's no real detail anywhere on the website in terms of specs or build, meaning users have no real idea what they're actually signing up for. But when The Daily Beast had somebody take a closer look at the device, they found it was likely a Chinese-made A9Pro (retail: $120) running a modified version of Google's Android OS dubbed "FreedomOS":

"Freedom Phone appears to be a simple rebranding of a budget phone called the “Umidigi A9 Pro,” made by the Chinese tech company Umidigi. In an interview with The Daily Beast, Finman confirmed that the Freedom Phone was manufactured by Umidigi, but couldn’t say immediately which Umidigi phone it was based on.

The Freedom Phone’s $500 price tag would represent a substantial markup on the Umidigi A9 Pro. That phone is available on Chinese retail giant AliExpress for $120 — less than one quarter of the price of a Freedom Phone."

The phone in question appears to be one of several discounted Android phones with insecure configurations that are vulnerable to a long list of trivial vulnerabilities. The low cost, high-customizability of such phones make them more vulnerable than more expensive options, and less likely to see consistent security updates. In short, the Freedom phone appears to not only be an overpriced version of a fairly underwhelming phone, it potentially makes its customers more vulnerable to the type of spying and government surveillance they're being told they're avoiding.

In a post to Twitter, the phone's creator proclaims the phone is "the first major pushback on the Big Tech companies that attacked us - for just thinking different." Though as several Twitter users were quick to point out, a completely unmoderated or managed app store means it's easy for any random idiot (or government) to launch a bevy of privacy-violating and malware-laden apps designed to hoover up your personal details:

As Gizmodo notes, the ironic part is there's ample resources for folks genuinely interested in freeing themselves from Google and Apple. There's massive online communities designed around letting you bypass the Android/iOS gatekeeper logjam, often for a fraction of the cost of the Freedomphone. The Linux-based Pine phone, for example, offers a significantly cheaper option with greater transparency into what you're actually buying. The /e/ Foundation also sells refurbished and "de-Googled" discount phones that are likely notably more secure at a lower price point (with caveats).

Of course this all assumes that you genuinely care about privacy and aren't just gesticulating wildly based on a bunch of bullshit fed to you by a NYC real estate conman with a terrible combover.

Filed Under: android, censorship, china, erik finman, freedom phone, maga

Trump Campaign Gets Parody Cartoon Taken Down Off Redbubble Over Trademark Claim On MAGA Hats

from the 2020-in-a-nutshell dept

If I had to come up with a more 2020 headline than the above, I'm not sure I could. Still, this is also in the Techdirt wheelhouse as far as topics are concerned. For background, I think it's fair to say that the Trump Campaign, and Donald Trump as well, have both built a reputation for themselves as being particularly litigious when it comes to all things IP, defamation, etc. etc. amen. Whatever your politics, it simply can't be denied that on First Amendment grounds, our current president and his organizations have an abysmal reputation on matters of free speech, so long as that speech could potentially pierce the notoriously thin skin of Donald Trump.

This continues to today, of course. You can see it when there are executive orders issued just because social media companies point the public to facts about the President's claim. You can also see it more recently in the Trump campaign issuing a takedown with Redbubble for a parody cartoon over the trademark on MAGA hats.

The Pulitzer-winning cartoonist Nick Anderson has described Donald Trump as an “adolescent wannabe authoritarian”, after the US president’s re-election campaign failed to pull one of Anderson’s cartoons mocking Trump’s inaccurate suggestion that injecting disinfectant could protect against Covid-19. Anderson put his cartoon The Trump Cult up for sale on the online retailer Redbubble this month. The illustration shows Trump with supporters in Maga hats, serving them a drink that has been labeled “Kool-Aid”, then “Chloroquine” and finally “Clorox”, a US bleach brand.

But Redbubble pulled Anderson’s illustration from sale following a trademark infringement claim made by Trump’s campaign organisation, Donald J Trump for President Inc. Writing on the Daily Kos, Anderson said that he believed the claim was made due to his depiction of Maga hats, and described the situation as “absurd”.

Frankly, "absurd" doesn't even begin to describe it. All kinds of speech are protected by the First Amendment, whatever the trademark rights any holder might have. Political speech is probably more revered in that regard than any other speech. The very idea that an artist couldn't create parody art that comments on a particular public figure and/or his or her voting block is so completely the antithesis of American history that one should really just have to yell something like, "The Federalist Papers!" at this sort of thing and be done with it.

This country was built on political parody. And, frankly, cartoon parody in particular. The Trump campaign does, or at least should, know this. Redbubble does too, which explains the fairly very good mea culpa that it issued when the site reinstated the cartoon.

Redbubble reinstated Anderson’s cartoon this week, saying that it strives “to respect IP rights and freedom of speech, but we sometimes make mistakes, as we did here … We’re sorry for any inconvenience this has caused.” In a statement, Anderson praised Redbubble for recognising the error, but said there were some “troubling issues” raised by the affair, including that the cartoon was removed less than 24 hours after he posted it, before he had received a single order.

“I doubt anyone had even seen it yet on the site,” he said. “This reveals that the Trump campaign has a system in place, trawling for material they find objectionable. If it happened to me so quickly, it likely has happened to others. How much other content has been removed this way on Redbubble and other sites?”

While fair, the real issue here is that a demand for proactively policing copyright and trademark abuses is a system ripe for abuse, for censorship, and for fallout around the takedown of protected speech. This serves as simply a pointed example of this sort of thing, given that we're talking about a sitting President's campaign taking down such political speech. While this was ultimately corrected, the idea that something so American as a political cartoon could have been disappeared, even temporarily, over such a specious trademark claim is highlighting a flaw in the system.

So let's get it corrected.

Filed Under: censorship, donald trump, maga, nick anderson, political cartoons, takedowns, trump campaign
Companies: redbubble

Security Researcher Discovers Flaws In Yelp-For-MAGAs App, Developer Threatens To Report Him To The Deep State

from the shooting-the-messenger dept

Even a cursory look at past stories we've done about how companies treat security researchers who point out the trash-state of their products would reveal that entirely too many people and companies seem to think shooting the messenger is the best response. I have never understood the impulse to take people who are essentially stress-testing your software for free, ultimately pointing out how the product could be safer than it is, and then threatening those people with legal action or law enforcement. But, then, much of the world makes little sense to me.

Such as why a Yelp-for-MAGA people should ever be a thing. But it absolutely is a thing, with conservative news site 63red.com releasing a mobile app that is essentially a Yelp-clone, but with the twist that its chief purpose is to let other Trump supporters know how likely they are to be derided when visiting a restaurant. This is an understandable impulse, I suppose, given the nature of politics in 2019 America, though the need for an app seems like overkill. Regardless, the app was released and a security researcher found roughly all the security holes in it.

On Tuesday, a French infosec bod, going under the Mr Robot-themed pseudonym Elliot Alderson and handle fs0c131y, notified 63red that it had left hard-coded credentials in its Yelp-for-Trumpistas smartphone application, and that whoever built its backend APIs had forgotten to implement any meaningful form of authentication.

Alderson poked around inside the Android build of the app, and spotted a few of insecure practices, including the username and password of the programmer, and a lack of authentication on its backend APIs, allowing anyone to pull up user account information, and potentially slurp the app's entire user database. It's also possible to insert data into the backend log files, we're told.

In other words, what 63red meant to build was an app to let Trump supporters know where they can go to feel safe. What it actually built was an app that tried to do that, but instead exposed user information to anyone who wanted to mine for it or, say, build a list of Trump supporters for reasons that could be entirely nefarious. Not great.

Nor was the reaction from 63red, which decided that Alderson pointing out its shoddy work warranted a threat to refer him to the FBI, AKA the Deep State.

"We see this person’s illegal and failed attempts to access our database servers as a politically-motivated attacked, and will be reporting it to the FBI later today," 63red's statement reads. "We hope that, just as in the case of many other politically-motivated internet attacks, this perpetrator will be brought to justice, and we will pursue this matter, and all other attacks, failed or otherwise, to the utmost extent of the law."

63red described the privacy issues as a "minor problem," and noted that no user passwords were exposed nor any user data changed.

For his part, Alderson took the threat of an FBI referral in full stride. Far from quaking in his boots, he simply pointed out that 63red's security was so non-existent that he didn't need to commit any crimes to do what he did.

"The FBI threat is a threat, I didn’t do anything illegal," he told The Register. "I didn’t break or hack anything. Everything was open."

And now this whole story is getting far greater coverage due to the threat than it would have had 63red simply, you know, secured their app based on the freely given information provided by a white hat security researcher.

I'm sure the folks using this app couldn't feel more safe.

Filed Under: donald trump, maga, reviews, security, threats
Companies: 63red