South Korea Shoots The (Smart) Sheriff; Pull Support For Mandated, Severely Flawed Cellphone Spyware App

from the will-just-need-to-find-better-spyware-to-mandate dept

The South Korean government's strong suggestion parents should install spyware in their kids' phones resulted in the the official blessing of Smart Sheriff -- a program that hoovered up communications and data and sent it all back to the MOIBA mothership with a minimum of security. Citizen Lab security researchers found numerous flaws in the spy app, ranging from the unencrypted transmission (and storage) of data to the circumvention of HTTPS protections in order to check sites against blacklists.

In response to the diclosure of these vulnerabilities, the South Korean government has put the Sheriff down.

Moon Hyun-seok, a senior official at the Korea Communications Commission, told The Associated Press that "Smart Sheriff" has been removed from the Play store, Google's software marketplace, and that existing users are being asked to switch to other programs.

The government plans to shut down the service to existing users "as soon as possible," he said.

In the meantime, Smart Sheriff will continue to barely protect the vast amount of data it's been entrusted with. A follow-up report by Citizen Lab notes that, despite being notified more than 90 days ago, the developer has yet to address many of the vulnerabilities reported to it by the researchers.

A second audit of the Smart Sheriff application reveals that there are numerous unresolved security vulnerabilities that put minor children and parental users of the application at serious risk.

MOIBA, the Korean industry consortium responsible for the Smart Sheriff application, has been slow to respond to the issues raised (of which it was notified more than 90 days ago); the fixes that have been applied do not adequately or effectively address the issues, especially for users; and MOIBA has not communicated transparently to the public about Smart Sheriff’s known risks.

Citizen Lab recommended the removal of the spy app from the market, with its recommendation arriving only a day ahead of the South Korean government's official announcement. The researchers still consider the app to be highly-exploitable, thanks to MOIBA's half-assed patch job. At this point -- with the app still in wide use -- the only thing not leaking information is MOIBA's PR team.

Smart Sheriff's maker, an association of South Korean mobile operators called MOIBA, declined comment.

MOIBA claims to have addressed the issues raised by Citizen Lab, but researchers point out most of the "solutions" were cosmetic. The underlying vulnerabilities remain.

Overall, while some changes have been made in response to the initial disclosure made by Citizen Lab to MOIBA, attackers still have most of the same opportunities to exploit vulnerabilities in the application as they did in previous versions. Many of the issues that were marked as high priority in the previous report, such as the lack of protections around sensitive private data, and transport security, remain effectively unaddressed.

That the government has made the move to kill the app and repeal its support is a positive step, but it's one that took place at several terrible decisions. Mandating spyware for phone users is already a problem, no matter the intent behind it. If parents want to spy on their kids' phone use, it should be up to the parents, not the government. That the government threw its weight behind an app whose developers couldn't even be bothered to implement halfway decent security measures until after researchers discovered the holes makes this even worse.

Filed Under: filters, smart sheriff, south korea, spyware, surveillance

Government-Mandated Parental Spyware Found To Be Leaking Personal Data At An Alarming Rate

from the dysfunctional-by-design dept

A few months ago, the South Korean government strongly suggested parents load their children's cell phones up with government-approved spyware. It recommended an app called "Smart Sheriff." The app provided plenty of reassurance for parents, if said parents were willing to let the government look over their children's shoulder while they browsed the web, chatted about kid/teen things or otherwise engaged with their devices.

It also claimed to block porn, alert parents to budding sexuality and otherwise ensure no amount of phone use was left unreported. And, if South Korean parents somehow felt the government might be overstepping its bounds a bit, cell phone providers were obliged to hassle parents about underuse of the government-approved spy app.

Now, it appears that everything the mandated spyware grabs, it also leaks in one form or another. Citizen Lab (the same entity that sniffed out the connection between malware provider Hacking Team and blacklisted governments) has audited Smart Sheriff and has found its security measures to be mostly terrible. Not only does the recommended app not protect the transmission of personal data, but it doesn't even live up to the government's own standards for data and information security.

Citizen Lab has uncovered a plethora of flaws that make Smart Sheriff even worse than it was when it was simply government-approved spyware.

We identified twenty-six vulnerabilities and design issues that could lead to the compromise of user accounts, disclosure of information, and corruption of infrastructure. The same issues were often present in multiple parts of the application and infrastructure. For example, we identified a potential attack against user accounts via the Smart Sheriff mobile application, then determined that it could also be made against the Web-based parental administration site. These multiple flaws suggest that the application was not fully examined for security issues before being released. Both audits were done in a limited window of time and without access to the original source code.

Smart Sheriff loads up on personal data during registration, demanding the phone numbers of both children and parents, along with the child's gender and date of birth. The information keeps flowing while in use, gathering data on apps installed and used, as well as browsing history. Then it transmits all of this information (some of it in plaintext) back to its storage, which is unencrypted. (This makes a certain sort of sense, considering the transmission of data is similarly unencrypted. Why lock it down in storage if you can't be bothered to arrange for its safe travel?)

What comes through as plaintext is the user's browser history. Visited sites are matched against a blocklist. (Strangely, no sites are actually blocked, as this function raised concerns about user privacy. But it still gathers the data, sends it in plaintext and stores it in unencrypted form. So these privacy concerns are sabotaged just as soon as they're addressed.) In order to match sites against its blocklist, the software edges around HTTPS protections to match the user to the site visited.

Beyond that, the software's authentication process can be decrypted by reverse engineering or decompiling the app. There's layer upon layer of inadequate security that adds up to a total catastrophe should anyone manage to make their way through any number of easily-prised doors.

The primary mechanism for authentication across the Smart Sheriff service is a device identifier that is derived using reversible obfuscation rather than industry-standard encryption. If an attacker is able to guess, enumerate, or intercept the device identifier of a phone with Smart Sheriff installed, the attacker can impersonate the application and undertake a range of attacks.

For example, using only the device identifier, an attacker can impersonate a user and request the parents’ phone number, children’s names, and their dates of birth. Moreover, an attacker can use the Smart Sheriff API to request a parent’s administration code (itself an insecure four-character string) and use it to take control of the account.

Basically, the app is good enough for government work, as the saying goes. The government desires its public to have more control over the actions of their children. This, in turn, allows the government to have more control over the parents. The "do something" do-goodery we see in our own legislators is echoed here. In response, a "good enough" solution is mandated, even if it's not actually good enough. No one in charge of these mandates seems to care too much about the security flaws and gaping holes -- not even the company that made the app.

After our disclosure, MOIBA released an update to Smart Sheriff (v1.7.6) that includes communication over HTTPS. However this version does not properly validate the credentials received and appears to accept a self-signed certificate, which minimizes the update’s effectiveness.

As Citizen Lab points out, the software does too much and too little, simultaneously, gathering the worst aspects of both. It fails to meet government guidelines on information security while going much further with surveillance and control than the government has actually mandated. The worst part of it is that the government has mandated use of the software, which gives citizens no option but to place its children's privacy in the hands of an entity that clearly has no respect for it. On top of that, it makes parental monitoring of children's cell phone use the new normal, which only makes it easier for the government to make further related demands down the road.

Filed Under: leaks, privacy, smart sheriff, south korea, spyware
Companies: citizen lab

South Korea's New Law Mandates Installation Of Government-Approved Spyware On Teens' Smartphones

from the please-spy-on-our-behalf,-thx! dept

Considering the extent of its (most web-related) censorship efforts, South Korea must consider itself fortunate to be next-door neighbors with North Korea. Any time another censorship effort arrives, all the government has to say is, "Hey, at least we're not as bad as…" while pointing its index fingers in an upward/roughly northerly direction.

It blocks sites and web pages with gusto, subverting its own technological superiority by acting as a Puritanical parental figure. Not that it helps. Every time the government ropes off one area, citizens carve out another. Four years ago, it attempted to pass a law making government-approved computer security software installation mandatory, supposedly in hopes of heading up the enlistment of citizens' computers into botnet armies.

Now, it's telling parents they must install government-approved and crafted spyware on the smartphones of any children under the age of 19.

The app, "Smart Sheriff," was funded by the South Korean government primarily to block access to pornography and other offensive content online. But its features go well beyond that.

Smart Sheriff and at least 14 other apps allow parents to monitor how long their kids use their smartphones, how many times they use apps and which websites they visit. Some send a child's location data to parents and issue an alert when a child searches keywords such as "suicide," ''pregnancy" and "bully" or receives messages with those words.

Last month, South Korea's Korea Communications Commission, which has sweeping powers covering the telecommunications industry, required telecoms companies and parents to ensure Smart Sheriff or one of the other monitoring apps is installed when anyone aged 18 years or under gets a new smartphone. The measure doesn't apply to old smartphones but most schools sent out letters to parents encouraging them to install the software anyway.

No one appears to have taken a close look at the inner workings of "Smart Sheriff" at this point, but a similar app known as "Smart Relief" also allows parents to monitor their children's smartphone activities and sends alerts triggered by any of the 1,100+ words on its watchlist.

Some terms it monitors (both in text messages and searches) would obviously raise concerns in parents.

Threat, kill, shut up, violence, destroy, handicap, crazy, prostitute, garbage, thief, porn, suicide, pregnancy, inn, obscene, sex, sexual crime, sexual relationship, prostitution, motel, beer, rape, adultery, run away from home, outcast, invisible person, don't have friends, jealousy, lonely, stress, don't want to live, loser, complaint, help, worry, menstruation, adoption, divorce, rape, homosexual love, single parent, IS, terrorism, poison...

Other trigger terms seem to do nothing more than give parents a reason to lock their kids up until they're old enough to move out:

Girl I like, boy I like, dating, boyfriend, girlfriend, breakup…

This new mandate is obviously creating a chilling effect. Some have noted the Smart Sheriff app may give government agencies access to minors' communications, all under the pretense of helping parents out. Nearly 80% of South Korean schoolchildren (teens and elementary students) own smartphones. That's a whole lot of communications potentially being delivered to law enforcement and intelligence agencies (if not also to schools and service providers).

As a result, smartphones are now no longer viewed as essential equipment by teenagers.

To get around the regulations, some students say they will wait until they turn 19 to get a new phone.

"I'd rather not buy a phone," said Paik Hyunsuk, 17. "It's violation of students' privacy and oppressing freedom."

Open Net Korea, which has tracked South Korean censorship efforts for years, has a translation of the law's stipulations, which not only requires installation of government-approved spyware apps, but also stipulates cell phone providers actively hassle parents who don't seem to be taking the mandated monitoring seriously.

Article 37-8 (Methods and Procedures for Providing Means to Block Media Products Harmful to Juveniles, etc.)

(1) According to Article 32-7(1) of the Act, a telecommunication business operator entering into a contract on telecommunications service with a juvenile under the Juvenile Protection Act must provide means to block the juvenile’s access to the media products harmful to juveniles under the Juvenile Protection Act and the illegal obscene information under Article 44-7(1)1 of the ICNA (“Information harmful to juveniles”) through the telecommunication service on the juvenile’s mobile communications device such as a software blocking information harmful to juveniles.

(2) Procedures prescribed below must be followed when providing the blocking means under (1):

At the point of signing the contract:
a. Notification to the juvenile and his/her legal representative regarding types and features of the blocking means; and
b. Check on the installation of the blocking means.

After closing the contract:

Monthly notification to the legal representative if the blocking means was deleted or had not been operated for more than 15 days.

So, not only is it censorware and spyware, but it's also apparently nagware -- with telecom reps calling or emailing every month to remind parents to perform their duties as proxy surveillance operatives for the South Korean government.

Filed Under: mobile phones, smart sheriff, smartphones, south korea, spyware, teenagers, teens