Using Google Maps To Intercept FBI and Secret Service Calls 137
An anonymous reader sends in a story about a network engineer named Bryan Seely, who was tired of seeing fake listings and spam on Google Maps. He contacted the company and tried to convince them to fix their system, but didn't have much luck. Afterward, he thought of an effective demonstration. He put up fake listings for the FBI and the Secret Service with phone numbers that sent the calls to him. When people called, he forwarded them to the actual agencies while he listened in. After recording a couple of calls for proof, he went to a local Secret Service office to explain the problem:
"After that, Seely says, he got patted down, read his Miranda rights, and put in an interrogation room. Email correspondence with the Secret Service indicates that the special agent in charge called him a 'hero' for bringing this major security flaw to light. They let him go after a few hours. Seely says the fake federal listings, which were both ranked second every time I checked Google Maps, were up for four days. He took them down himself when the Secret Service asked."
Gee, didn't they tell us ... (Score:2)
Re: (Score:2)
i'm really happy with apple maps these days. the directions work well and it doesn't track and report back my location like google maps does, while it sits in the background.
To your knowledge. But unless you have the source code, you don't really know what either is tracking or who they're selling the information to.
It's more likely that google is just more open and honest about how they use the information they have about you. They admit openly that the main reason for their success is their "marketing" ability. Customer/client information is a valuable commodity, and the marketers at any corporation you deal with would be fools to not monetize the information they manag
Re: (Score:2)
It's more likely that google is just more open and honest about how they use the information they have about you. They admit openly that the main reason for their success is their "marketing" ability. Customer/client information is a valuable commodity, and the marketers at any corporation you deal with would be fools to not monetize the information they manage to collect.
This is the same reason facebook pisses me off with their recent changes, but google+ doesn't really bother me.
Re: (Score:2)
Gee, didn't they tell us only Apple Maps had problems?
Only if "they" refers to Slashdotters or tech pundits. But Apple Maps *did* have significant - even egregious - errors/problems at launch. It seems quite usable now.
My preferred navigation app has been Waze, but that is unfortunately going downhill since the Google acquisition. They seem more interested in adding ads rather than fixing the app's shortcomings. It's usually really good for highways and major thoroughfares (although oddly enough it picked a really weird and obviously wrong route for me after t
Re: (Score:2)
Gee, didn't they tell us only Apple Maps had problems?
Actually, if you were paying attention, you'd have noticed that google documented and discussed their mapping problems quite openly. They did this especially around the time they started up their fleet of "google vans" that have been remapping the world. Their explicit, stated reason for this was the ongoing problems with the bad data they were getting from their map sources. These were ultimately the thousands upon thousands of local maintainers of the the maps for their jurisdictions, combined with th
Re: (Score:2)
Gee, didn't they tell us only Apple Maps had problems?
Actually, if you were paying attention, you'd have noticed that google documented and discussed their mapping problems quite openly.
Yeah, they just refused to fix them. Which TFA is all about.
Patting down (Score:4, Funny)
Re:Patting down (Score:4, Funny)
I like my coffee like I like my Secret Service agents -- black helicopters.
Old news. (Score:4, Interesting)
When I was working in retail about 5 years ago competitors of ours did the same. Our store name, their phone number.
That's similar to why dial phones were invented. (Score:5, Interesting)
When I was working in retail about 5 years ago competitors of ours did the same. Our store name, their phone number.
That reminds me of why dial phones were invented.
Early telephone exchanges used an operator to connect all calls. You picked up the phone and this lit a lamp and sounded a buzzer at an operator's console in the central office. The operator pulgged a cable into a jac and talked to you, found out who you wanted to talk to, and plugged another cable into the other customer's jack (or a trunk to another operator) to hook you up. Similarly when you hung up, or (if the call needed some other modification and you "flashed" by flicking the hook switch).
Some businesses bribed unscrupulous operators to redirect their competitor's calls to them, stealiing some of their buiness (especially in high customer turnover businesses, where a large fraction of the calls were initial contacts.) There was much flap over this, of course.
One such customer - an undertaker - decided to attack this problem at its root. He also happened to be what we'd now call a hacker (in the "exceptionally competent technologist" sense). He developed the earliest version of a dial telephone system, and got one of the telephone companies serving his area to install it. Electromechanical stepper switches were not susceptable to bribery, problem solved.
Of course electromechanical stepper switches are also cheaper than even low-wage people. So dial systems caught on very quickly. You still needed operators for non-simple stuff, but a company handling the bulk of the calls mechanically needed far less of them, and when such service was available businesses switched over en masse.
Re: (Score:2)
Re: (Score:2)
This is much. much older than that. Once upon a time, probably soon after paper and writing were invented, someone invented the bulletin board. Initially people used it to post messages. Then someone posted an advertisement for their apple wagon just up the street. Then someone else changed the location in the ad to the location of their apple wagon just down the street.
Probably took a little longer than that, if only because for the trick to work you need:
1) enough literate people to matter
2) a community large enough that not everybody knows everyone else.
Directly contacting gov agencies. Good idea? (Score:5, Interesting)
But there will be access logs and ip addresses saved in all kinds of places that will have evidence that I had stumbled on to that security hole. If I try to cover my tracks that would be even more trouble for me.
I don't know what the right thing to do would be. May be I should spring for a lawyer, document everything with my lawyer and use the lawyer to contact the agencies.
Is there a recommended way by FBI or Secret Service where one can go, establish the non-criminal bona-fide of oneself and have an intelligent conversation with someone and point out such security flaws? It is in the interest of FBI to maintain such a unit.
Re:Directly contacting gov agencies. Good idea? (Score:5, Interesting)
I've done it, exposing criminal fraud of spammers. I happened to be visiting DC, so took the time to meet the agent whom I'd been corresponding with and trying to get Secret Service interest because I thought it would fall under wire fraud. Local police departments had been unwilling to deal with it without proving that the spammers were from their jurisdiction, and wouldn't bother obtaining the warrants needed to get ISP logs without that proof. And the FBI kept blowing me off.
The Secret Service agent I spoke with was interested, but let me know why he couldn't justify further investigation. Without a clear abused victim with a clear monetary damage of at least $30,000, he couldn't justify obtaining the necessary necessary agency time to get the warrants to track the spammers and the fraud. So I learned a hard lesson: getting the specific criminal act of large enough damage to *justify* prosecutorial interest is key. It's why so many low scale spammers and fraudsters continue so long: they operate under the radar of police or FBI or Secret Service wire fraud thresholds.
It's a lesson that's been helpful to me in security work: It really helps to have a killer risk or a single incident to hang justification for the change in practices or policies on, as a managerial justification for time and money and resources.
Re:Directly contacting gov agencies. Good idea? (Score:5, Insightful)
The Secret Service agent I spoke with was interested, but let me know why he couldn't justify further investigation. Without a clear abused victim with a clear monetary damage of at least $30,000, he couldn't justify obtaining the necessary necessary agency time to get the warrants to track the spammers and the fraud. So I learned a hard lesson: getting the specific criminal act of large enough damage to *justify* prosecutorial interest is key. It's why so many low scale spammers and fraudsters continue so long: they operate under the radar of police or FBI or Secret Service wire fraud thresholds.
On the other hand... had that spammer tried to sell *one* bootleg copy of a movie...
Re: (Score:2)
Why do you think the punitive fines for copyright infringement are easily $125,000+ per violation?
Re: (Score:3)
he couldn't justify obtaining the necessary necessary agency time to get the warrants to track the spammers
Snowden's documents showed that the FBI was getting information from the NSA on drug traffickers without obtaining warrants.
Re: (Score:2)
he couldn't justify obtaining the necessary necessary agency time to get the warrants to track the spammers
Snowden's documents showed that the FBI was getting information from the NSA on drug traffickers without obtaining warrants.
Yeah, but that's DRUGS. Don't you know there's a war on DRUGS?
Re:Directly contacting gov agencies. Good idea? (Score:4, Funny)
Re: (Score:1)
If it was large enough for the NSA to trip over (that is how these findings got from NSA to FBI and DEA, they tripped over them, said "hey this isn't terror, but someone might care") it was bigger than the fraudster.
No solution... (Score:1)
Sorry, you seem to be under the impression that there exist in the U.S. "non-criminals" from the perspective of L.E. agencies.
Re:No solution... (Score:4, Funny)
Sorry, you seem to be under the impression that there exist in the U.S. "non-criminals" from the perspective of L.E. agencies.
Of course they exist. They're everyone above you in the chain of command.
Re: (Score:2)
It can even include those above you in the chain of command. Anyone below the highest person in the chain of command whose backing you have is also a potential criminal target.
Re:Directly contacting gov agencies. Good idea? (Score:5, Insightful)
yes, even being near a crime can get you in trouble.
there was a time that I saw a car up on blocks with its wheels gone (down the street from where I used to live, a nice safe area in mtn view). I thought it odd that there was such a theft like this and I had my camera with me at the time so I shot a few pics. a cop came by and started hassling me. at the time, I had no idea why.
when I asked around (and did some research) it seems that some thieves do their deed and then come back again to photo it, maybe for bragging rights or something. and so, if you take pics of something like this, you may run into some 'questioning' from those in blue. sad but true.
I would not ever voluntarily go talk to a cop or walk into a cop station, these days. you put yourself at risk every time you encounter one of those guys. I don't need problems in my life so I avoid those guys at all cost even though I'm not doing a single thing wrong.
lesson: don't tangle with authority unless you have all your bases covered. even then, if its not your business, just stay the hell out of their sphere. these days, we are all 'suspects' and even a perfectly innocent person can run into trouble in spite of having neutral or even good intentions.
Re: (Score:2)
Strange, why would they think the suspect would leave, and then come back for the photos? Most people who would do that know they have very little time to work. Once the car is noticed missing or found, they're done. Sure, they like their trophies, but going back the next day is a huge risk they usually aren't willing to do. It's safer to steal another car for anything they may have forgotten.
Re: (Score:2)
Sort of similar ..
http://www.dnainfo.com/new-york/20140227/central-harlem/man-arrested-after-sending-selfie-nypd-from-stolen-phone-officials-say [dnainfo.com]
Re: (Score:2)
Re:Directly contacting gov agencies. Good idea? (Score:5, Insightful)
I would not ever voluntarily go talk to a cop or walk into a cop station, these days. you put yourself at risk every time you encounter one of those guys.
You've got serious problems there if a law abiding citizen cannot talk to the cops.
Re:Directly contacting gov agencies. Good idea? (Score:5, Insightful)
With all the laws we have now the idea of a "law abiding citizen" is a fantasy. Everyone has broken some law.
Re: (Score:1)
The real issue is that law enforcement has become big business. They're out for convictions, doesn't matter if you actually did anything illegal or not.
Re: (Score:3)
... the idea of a "law abiding citizen" is a fantasy. Everyone has broken some law.
Actually, people have been discovering this and writing about it for decades. And it's not just an American problem; pretty much everywhere in the world, it's not possible for a mere human to follow all the laws.
For lots of explanations of why, you can ask google about "everyone is a criminal" or "no one is innocent". This does get you lots of mere complaints similar to what we've been reading here, but it also turns up a lot of detailed explanations.
It's common for writers to find funny examples of
Re: (Score:2)
Except as otherwise provided in this title, whoever without authority makes, uses, offers to sell, or sells any patented invention, within the United States or imports into the United States any patented invention during the term of the patent therefor, infringes the patent. [Title 35 Part III Chapter 28 Section 271(a)]
Re: (Score:3)
Re: (Score:2)
I would not ever voluntarily go talk to a cop or walk into a cop station, these days. you put yourself at risk every time you encounter one of those guys.
You've got serious problems there if a law abiding citizen cannot talk to the cops.
You said it, not me....
Now if only everyone else could connect those dots and vote/run for office appropriately.
Re: (Score:2)
You've got serious problems there if a law abiding citizen cannot talk to the cops.
Welcome to Amerikka. Here's some links from my history.
http://photographyisnotacrime.com/2013/09/06/illinois-cops-threaten-confiscate-mans-camera-recording/ [photograph...acrime.com]
http://filmingcops.com/parents-outraged-after-cop-asks-their-12-yr-old-child-for-sexual-photos/ [filmingcops.com]
http://abcnews.go.com/US/court-oks-barring-high-iqs-cops/story?id=95836 [go.com]
http://www.blackyouthproject.com/2014/01/cops-beat-deaf-man-for-7-minutes-because-he-didnt-respond-to-them/ [blackyouthproject.com]
http://www.rawstory.com/rs/2013/11/28/yale-professor-found-dead-in-his-jail-cell-ho [rawstory.com]
Re: (Score:3)
To cops in the US, there's no such things as "law abiding citizens." There are two classes of people: cops, and potential criminals.
Tim Masters would agree... (Score:1)
"you put yourself at risk every time you encounter one of those guys"
nail! head! SMACK!
here's my philosophy which I'm teaching our kids: NOTHING good can come from interacting with a cop - NOTHING! the best you can do (& to be fair likely will majority of time) is break even & the alternatives go downhill in a hurry... it's like a reverse lottery ticket - 99.9% of the time (& I think that #'s generous) you get nothing but when you "hit" you get arrested for taking a picture of an ATM or res
Directly contacting gov agencies? Horrible idea! (Score:2)
Is there a recommended way by FBI or Secret Service where one can go, establish the non-criminal bona-fide of oneself and have an intelligent conversation with someone
I did some minor computer consulting for the Secret Service a long time ago. I was too young at the time to realize what was going on; only in retrospect years later did I realize that there had been zero effort to preserve electronic evidence, share it with the defense, or any of the other niceties one is supposed to expect from the justice
Best to never be a person of interest (Score:2)
....any interest.
It just seems to me that the best policy is to not have your name put on any law enforcement list of any kind unless there is some moral imperative that would compel you to, like being a witness to a crime.
This is kind of sad, because I would think it would be nice to be able to provide meaningful information to law enforcement but there just seems to be too many ways it could turn around and bite you, especially if your helpful information was deemed to be something that could be embarrass
Re: (Score:2)
The FBI are nice folks, they get to deal with some really messed up people.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Lucky (Score:4, Insightful)
Re:Lucky (Score:4, Insightful)
The Secret Service actually hires intelligent people. If it had been the TSA he'd still be in jail.
Re: (Score:1)
You have to look at the type of crime they handle. The first is attacks on the President and financial fraud. Both of those require intelligent people. The first because the President gets loons threatening him everyday and it takes smarts to figure out which are the real threats. The second does too because it is a lot of forensic accounting. Actual fieldwork would be done by a very specialized unit in the former and the FBI working with the SS for the latter.
Re: (Score:2)
The agency abbreviation is USSS. It doesn't help that everyone knows them as "Secret Service", which is intuitively abbreviated to SS.
Re: (Score:1)
Just to godwin the thread, this is where Hitler came with the 'SS' for his most loyal troops...
Re: (Score:2)
The fact that Secret Service (in English) has the same alliterative letters, SS, is purely coincidental.
~~
Re: (Score:2)
And there is no relationship between homeland and fatherland. Of all the things they could have maned DHS, did they really need to Godwin themselves? :)
Re:Lucky (Score:5, Funny)
Re: (Score:2)
+1 tuttle or buttle?
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
He's one lucky bastard to get away with that.
Don't worry. He's in for a nice surprise the next time he travels abroad and tries to reenter the country. He may as well prelube before hitting customs. Emperors don't like the peons who point out that they have no clothes.
Re: (Score:2)
Re: (Score:2)
The FBI mostly doesn't hire ass clowns.
I wouldn't try this with the local sheriff's office.
Why would they care (Score:1)
about Google Maps? Is he going to pull the same stunt with fake listings on other sites/apps, local newspapers, shops, etc? And will he then repeat the process with the local police, hospitals, schools, shops etc etc? Where does it end?
Huh? (Score:1)
I don't understand. How is Google supposed to fix every wrong map listing? Does he have an algorithm to spot more of the fake listings? And how is this a security flaw, when there is no way to fix it? Ya, you can post any phone number you want in many different places, and label it as for the FBI, it just illegal to pass yourself off as a government agent. If it were me, I think I just world of arrested him.
But reading the original article, it starts to make sense when he mentions making a decision based on
Re: (Score:2)
- "I don't understand. How is Google supposed to fix every wrong map listing?"
By relying primarily on official and/or reliable sources.
- Business licenses
- Property tax rolls
- yellow pages listings
Yea, I get it. Google wants to make things more up-to-date by crowd-sourcing data. But you can't trust the "crowd". They need to make sure that new/changed listings are confirmed by multiple independent reports. And it would't hurt to at least glance at Street View to confirm...
"Here comes the Google van! Quick,
Re: (Score:2)
No kidding (Score:1)
Just try getting something fixed on Google Maps. It's nearly impossible. Sorry, let me amend that: It's nearly impossible if you are or work for/with the agency responsible for the legal addresses and contacts shown on Google Maps. If you are some Joe Blow who wants to randomly change some shit, then it appears to pretty friggin' easy to get something changed.
Google Maps has cost us thousands, perhaps 10's of thousands in costs associated with mail being sent to the wrong location over the last few year
Re: (Score:2)
I know of one other company in the area who says that their experience with Google is completely different. Of course, the biggest difference is that this company is engaged in 6 and 7 figure contracts with Google on a regular basis.
Reading between the lines: Do more business with Google or they'll make your life miserable with crappy listings. That's a nice little business ya' got there buddy. It'd be a shame if something happened to it......[Heh, heh, heh.]
Re: (Score:2)
If they're putting you through the the sales department, maybe you could buy some ads if they thrown in "fixing the damn address" as a bonus?
Then, sue them, I guess, for holding you address for ransom....
I can't say I really understood (Score:2)
Re: (Score:2)
Or just not very tech-savvy -- like the majority of internet users. Maps has taken the place of a phone book for a lot of people. I'll commonly get restaurant phone numbers out of Maps and not think twice about. I probably wouldn't trust it for 'important' information, but then I know well how easy it is to manipulate certain data online.
Think of it from the perspective of somebody w
Re: (Score:3)
Is this seriously a thing? I just don't understand why anyone would do this.
Of course it is. For example, you are hankerin' for some Indian food, and you know there's a place over on Maple street, but you don't know the name. So you pull up google maps and zoom in on Maple. There it is - Bombay Palace. You click on the little knife and fork icon to bring up the data, et voila: the phone number. How else would you look something up when you know where it is, but not what it's called?
Re: (Score:2)
Federal offices are merely an example. I know businesses that absolutely refuse to put their mailing address or the location of their offices or their business office telephone number on their website or in local telephone listings, to avoid physical spam or having angry customers show up at their door. And in the business world, just try to find the street address of the ISP data centers near you.
Google Maps has been a reliable way for me to actually _find_ the data center I need to visit, when the staff o
Re: (Score:2)
The addresses are frequently wrong too. Sometimes it's only off by one building. Sometimes it's off by miles. I usually give people coordinates to the entrance.
Of course, Google had to redo maps, removing features I used all the time, like "Drop Coordinates", which would display the coordinates at the point you selected. The distance ruler is gone too. They were beta features, but I used them all the time.
You can still pull the coordinates sometimes. Not always though. Sometimes it'll show in the
Re: (Score:2)
How did you find the URL for the website?
Which agencies have a location based search on their website? (FBI does, Secret Service does not, etc.)
How long would you mess around with that before you gave up and switched to Google Maps and searched for the agency starting with the map centered on your current location to find the closest local office for that agency?
I see it as less about Google being bad... (Score:4, Interesting)
And IMO, knowingly deceiving people (ie, deliberately misrepresenting your own number as a conduit for contacting somebody else) to try to expose a security flaw is still deception... and IMO, a severe ethical infraction, even if the law allows it when no real harm has been done.
Good ends should not require bad means to achieve. I believe that the means must justify themselves... and if that is just not possible, then... well, you just do the best that you can with whatever it is that you have, and go forward from wherever it is that you are.
Re:I see it as less about Google being bad... (Score:5, Informative)
True. One of the comments in TFA mentioned that this could be used for bank/credit card phishing. I thought that was an important insight to note. I think you'd get even more people blindly calling their bank based on a number on Google Local, and one could listen in and get all sorts of card numbers, social security numbers, secret passcodes, etc.
Re: (Score:3)
Re: (Score:2)
Re: (Score:3)
What I would have done? Warned as many people as I could that the numbers they see on there may not be accurate. Even if no deliberate deception was involved in them, they could be out of date and incorrect, because there are no safeguards in place to prevent errors.
And saying that nobody was harmed as a means to justif
Re: (Score:2)
Re: (Score:1)
How is this "Interesting". I am looking for a phone number, I don't got to 4 sources. I pick up the closest telephone book and dial what I see there.
"Fact checking" a phone number, wtf.
And then a +4 mod.
Lewis Black wouldn't even scream, he'd be struck silent this is so bad.
Re: (Score:2)
I've seen enough wrong numbers online to not trust what I find there.. usually, I imagine, it's the case that the numbers that I find are just seriously out of date rather than out of any deliberate intent to deceive.
I'm not especially smarter or wiser than anybody else. If I can think to do this, then anybody else should be able to as well.
Don't use Google maps - duh! (Score:2)
I quit using Google maps a long time ago when they showed the location of an address in the total opposite side of town when I knew darn good and well it wasn't where it said it was. Also showing my address on the WRONG side of the railroad tracks and 1 mile east of where it REALLY was. That is on top of all the spam garbage all over it. I have found MapQuest much more accurate and full of less BS. Google maps is just to "hackable". Anyone can make it show whatever they want - heck just see how easy it was
I wish the guy had gotten charged (Score:3, Insightful)
Re:I wish the guy had gotten charged (Score:4, Insightful)
... even though I actually agree talking with law agents is risky in certain places of the world right now.
When the topic is computer/communications security, talking to legal authorities is very risky anywhere in the world right now, but especially in the US. The usual reaction is to classify anyone with knowledge of security issues a "hacker", which is synonymous with "criminal" to most non-geeks. Demoing a security issue almost always leads to charges against the person doing the demo, not to fixes.
This is a lot of why our computer and communication systems are so insecure now. The people who are knowledgeable and competent to fix the problems tend to understand (typically by being burned) that working on such topics entails a high risk to one's own freedom or career, so they find jobs in other areas that don't entail working with the security aspects.
Not in jail? (Score:3)
How better to do it legally? (Score:2)
What would have been a better way to deal with this? Send in a warning and watch it be ignored?
Horrible idea (Score:2)