4

When software forces a user to verify online (phone home) before use, it creates an opportunity for private data created with this software to be physically connected to the Internet.

This may not be a big deal for some, but what if the data is sensitive or worth thousands of dollars? Even if the data is stored on a second drive that isn't plugged in, this doesn't mean there isn't an unknown exploit storing it on the OS hard drive.

Without requiring user to be a security expert, assuming their may be an exploit in the OS or in a running app, is there an absolute way to protect personal data created with an app requiring an online sign in?

Improve this question
2
  • HTTPS (which is essentially encrypted HTTP) is the standard to transmitting sensitive data over the web. But there's nothing you can do to ensure security if your operating system and/or software is compromised. – user2752467 Feb 25 '15 at 0:00
  • Any software you run can potentially initiate a network connection. You either have to blindly trust the software or isolate and do network analysis to see what data is being sent. In terms of licensing, they are more likely more concerned with piracy then the possible value of your data. – Eric G Feb 25 '15 at 4:01
1

When software "phones home" for licensing, it is exposing its own internal data to its developer, it's not exposing the data you created with it. The data you create are in separate files that are opened with the software.

If, on the other hand, you suspect that the software is intentionally also sending your private data to an off-site location, that's a separate issue that has nothing to do with "online verification before use" because the software could be doing this at any time. This situation is a trust issue, and can be verified with network monitoring.

Improve this answer
0

The most intuitive answer is to do your online checks before any sensitive data is present, and then to air gap the computer immediately. This is easily achieved on an ongoing basis by keeping the most sensitive data on a removable hard drive. Even if the software is spyware, it will be much harder for it to exfiltrate your data without an internet connection. I would do all of this at the beginning (on a fresh install) and never install any software like this until you are ready to format again.

Imagine this scenario:

  • First you install some software that turns out to be spyware
  • You airgap
  • The spyware collects your information into ram, and holds it there waiting for an internet connection.
  • During the next internet connected phase, the spyware phones home your info from ram.

This is a somewhat convoluted scenario, but it's certainly possible, and a good reason to be paranoid about what you do or don't install.

At the end of the day, it may be better to avoid such software if security is paramount to you. There is lots you can do to help prevent data being exfiltrated by a malicious program, but once you have been compromised all bets are off. Attackers are very smart.

For truly secure systems that need internet connectivity, periodic audits are necessary to ensure no data is being leaked. To be absolutely sure, you will need to also review source code where possible, and even reverse engineer programs to check them for hidden network functionality.

Port scanning yourself often is also a positive tactic.

To recap:

  • You can't be sure if programs are stealing your data without rigorously checking.
  • Check often.
  • Or just disconnect from the internet.
  • be very careful what you install.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.