Unauthorized alert sent to cell phones across Brazil
117 points by zdw 11 hours ago | 83 comments

WarOnPrivacy 5 hours ago
Disabling alerts is the second thing I do to a new handset (after rooting) - including Presidential alerts.

The Amber alerts I got were often hundreds of miles away. But even if they were closer - say only 25 mi away, I'm still not going to be any help.

Weather alerts weren't much better. Having my device sound the klaxons over Red Flag warnings conditioned me to ignore all alerts.

reply
fc417fc802 4 hours ago
While I understand how we arrived at this point I find these centralized systems with special privileges frustrating. That they have repeatedly exhibited severe vulnerabilities and mismanagement is just the cherry on top.

There ought to be a specification of an open protocol that includes certificate based authentication. I should be able to have my pick of which app to use and then subscribe to whatever feeds I'm interested in from anywhere in the world. In addition the local network operator should advertise various local feeds.

What I'm describing is about as technically complicated as RSS plus public keys but as usual even moderate technical competency is a bridge too far for the government.

reply
harrall 2 hours ago
It’s not a technical problem. And the problem is that it’s not centralized.

Everyone and their mom has their own system, managed by different people with different standards.

It’s like USB cables — yes there are strict technical standards but when you have a million different manufacturers, they all do it differently and some cut corners and bend the rules how they want to.

Look at how two different cities handle their water supply or their police — different management, different priorities.

reply
fc417fc802 2 hours ago
> It’s not a technical problem.

I agree. It's a lack of technical proficiency on the part of the world's government's problem, which is another way of saying it's a political problem.

> And the problem is that it’s not centralized.

It is, though. The implementation might not be uniform but the architecture is inherently centralized. Subscribers do not get to pick and choose sources, that is decided by the network operator (AFAIK).

Consider, if BigCo wanted the ability to push alerts to people on their campus (who consent to receive them ofc) how would they go about it? If you have family who live elsewhere in the world and wanted to be apprised of natural disasters how would you subscribe to receive those alerts?

reply
alister 4 hours ago
> Disabling alerts is the second thing I do to a new handset

Except you can't in Canada. The Canadian government has made the alerts mandatory. The option to disable alerts in not present in settings menu (at least on iPhones).

You can disable alerts in Brazil. So in one sense, Brazil is more free than Canada.

reply
gucci-on-fleek 4 hours ago
> The Canadian government has made the alerts mandatory. The option to disable alerts in not present in settings menu (at least on iPhones).

I'm Canadian too, and I'm able to toggle all the options off on my Android phone, it just does absolutely nothing and all the alerts still come through.

reply
WarOnPrivacy 3 hours ago
>> Disabling alerts is the second thing I do to a new handset

> Except you can't in Canada. The Canadian government has made the alerts mandatory.

Same for USG and Presidential alerts. I disable them anyway - which I can do after rooting. For one phone I deleted the PotUS alerts file. On another one I edited a config file. On my current handset, I disabled the wireless alert system.

reply
gucci-on-fleek 12 minutes ago
> Same for USG and Presidential alerts.

The problem is that Canada ignores all of the different categories, and just sends everything out as a presidential alert.

> I disable them anyway - which I can do after rooting

Yeah, I used to root my phone and do the same thing, but I don't any more since rooting is too easy to detect with hardware-backed Play integrity these days :(

reply
Onavo 2 hours ago
The biggest issue is that Amber alerts are abused for both kidnappings and abductions. In a lot of jurisdictions, the term "abduction" is used for cases of domestic disputes e.g the divorced mom left the state with the kid when she wasn't supposed to etc.

I really disagree with Amber alerts being issued in cases where there's no immediate risk of harm to the child, and especially if the child is a teenager. They can damn well decide who they want to be with themselves. The type of stuff that's better off being handled in family courts with contempt of court orders shouldn't be aired out like dirty laundry and domestic disputes should not wake up the entire city. It sucks for the parties involved but there are much bigger fish to fry and actual kidnappings and human trafficking to worry about than to cry wolf across the mobile network every time kids get caught in the crosshairs of a bad relationship.

Next time when you get an Amber alert actually read and check up on the background story.

reply
initramfs 8 hours ago
"The message sent was of the ‘Extreme Alert’ type and contained the word ‘misanthropy’ – which means hatred towards humanity. It is probably a hacker attack,” the agency’s statement said."

As this happens whenever there is an intrusion reported in the press, the word "hacker" is often misused:

"There is another group of people who loudly call themselves hackers, but aren't. These are people (mainly adolescent males) who get a kick out of breaking into computers and phreaking the phone system. Real hackers call these people ‘crackers’ and want nothing to do with them. Real hackers mostly think crackers are lazy, irresponsible, and not very bright, and object that being able to break security doesn't make you a hacker any more than being able to hotwire cars makes you an automotive engineer. Unfortunately, many journalists and writers have been fooled into using the word ‘hacker’ to describe crackers; this irritates real hackers no end.

The basic difference is this: hackers build things, crackers break them."

http://catb.org/~esr/faqs/hacker-howto.html

reply
gnubison 7 hours ago
As programmers in programming culture, we have a distinction between hacker and, potentially, cracker that no ordinary person has. ESR’s prescriptivism is pretty much worthless in this respect: words mean what people think they mean and what people use them for, and programmers do not have a monopoly on how people use the term.

OED has the “computer intruder” sense first cited in 1963, and the “enthusiastic programmer” sense first in 1969 (“now much less common than sense 3a”). Cracker first appears in 1968.

Besides, it is easy to disambiguate which meaning people mean. “Hacker attack” can only refer to the common usage of the term, not programming-culture usage.

reply
initramfs 7 hours ago
Thanks for highlighting the even earlier term from 1963. If that is the case, then why don't journalists use the word "computer intruder" instead of hacker, when it's less a catchall?

The funny thing about these comments is that most of the replies to my comment have been more defensive than my own. I wasn't suggesting a monopoly on the term, and I wasn't suggesting "hacker" shouldn't be ever be used. I just said it's not very accurate, and the average non-technical reader may not know the difference.

reply
mkl 5 hours ago
I think you misunderstood. The 1963 term is "hacker", and its 1963 meaning is "computer intruder". I.e. the journalists are using the earlier definition and the definition referred to by "Hacker News" came later.
reply
initramfs 4 hours ago
Ah, I see now that journos were referring to the older definition of hacker. I suppose newer interpretations have a ways to go in gaining acceptance, though I am not sure why the phrase hacker/cracker is even used, when other words could be used too, like tamperer (for intrusion) and tinkerer (for non-builder/non-intruder (i.e. on their own equipment, or a lab's equipment, and learner). Kind of like the phrase "me and the gang," although that word might never gain a total conversion, nor should.
reply
rzz3 8 hours ago
At this point, it’s just you misusing the word. You WERE correct; it did mean the builders rather than the breakers. But to greater society outside of the tech industry, hacking is hacking, they don’t need a word to describe builders, and crackers sounds dumb and no one outside the tech industry would know what you were talking about. A cracker is a snack and a dated slang word to refer to white people.
reply
Jtarii 2 hours ago
I'd just like to interject for a moment. What you're refering to as Linux, is in fact, GNU/Linux, or as I've recently taken to calling it, GNU plus Linux. Linux is not an operating system unto itself, but rather another free component of a fully functioning GNU system made useful by the GNU corelibs, shell utilities and vital system components comprising a full OS as defined by POSIX.

Many computer users run a modified version of the GNU system every day, without realizing it. Through a peculiar turn of events, the version of GNU which is widely used today is often called Linux, and many of its users are not aware that it is basically the GNU system, developed by the GNU Project.

There really is a Linux, and these people are using it, but it is just a part of the system they use. Linux is the kernel: the program in the system that allocates the machine's resources to the other programs that you run. The kernel is an essential part of an operating system, but useless by itself; it can only function in the context of a complete operating system. Linux is normally used in combination with the GNU operating system: the whole system is basically GNU with Linux added, or GNU/Linux. All the so-called Linux distributions are really distributions of GNU/Linux!

reply
vesche 4 hours ago
No one has used the word “hacker” with this esoteric / old school context in over 30 years.
reply
hollerith 4 hours ago
The name of the site you are writing this on is a usage of this "esoteric" meaning.
reply
vesche 4 hours ago
It was an intentional, near-archaic throwback even at the time HN was founded. Paul Graham has written about it, you can probably still find his blog written about it 20 years ago.
reply
pluc 8 hours ago
Cracker News was taken
reply
UqWBcuFx6NV4r 8 hours ago
I didn’t realise that people still fought this fight. it’s time to drop it, dude. It’s truly blatant language prescriptivism at this point.
reply
DrewADesign 5 hours ago
This is a blast from the past for sure. To me, someone who read 2600 magazine in the dial-up era, that argument seemed passé 15 years ago. The world at large agreed many years ago that the word ‘hacker’ commonly connotes system penetration, or at least security circumvention. Words can have multiple meanings.
reply
initramfs 7 hours ago
It's not so much a fight as a reminder of the technical words that actually distinguish one type from another. Are hackers considered ethical in the press today? 40 years of movies and press articles hasn't exactly made the idea of "white hat" a known term. https://en.wikipedia.org/wiki/White_hat_(computer_security)

It's kind of like Australia or the UK saying kids are "hacking" their PCs to use VPNS. There can be a very legitimate use of tools, but the portrayal of users bypassing blocks could just as easily be painted in a negative light.

One time someone made a joke or observation, 20 years or so ago, that their Myspace page was "hacked" because someone "posted on their wall". It's obviously not that misused, but just labeled that way when misinformed.

reply
dokyun 6 hours ago
And remember, kids, knowing how to program or wanting really badly to figure out how things work inside doesn't make you a hacker! Hacking boxes makes you a "hacker" ! That's right! Write your local representatives at Wikipedia/urbandictionary/OED and let them know that hackers are people that gain unauthorized access/privileges to computerized systems! Linus Torvalds isn't a hacker! Richard Stallman isn't a hacker! Niels Provos isn't a hacker! Fat/ugly, maybe! Hackers, no! And what is up with the use of the term "cracker"? As far as I'm concerned, that term applies to people that bypass copyright protection mechanisms. Vladimir Levin? HACKER. phiber optik? HACKER. Kevin Mitnick? OK, maybe a gay/bad one, but still WAS a "hacker." Hope that's clear.

-- The UNIX Terrorist

reply
antonvs 6 hours ago
This is like a new philosophy student objecting to someone saying, “This begs the question of whether…” It’s essentially a category error, an incorrect application of context.

You - and Eric Raymond, who believes he’s an incarnation of the god Pan - are both using a meaning of the word that has only ever been used in a relatively tiny subculture. That meaning has no bearing on its broader use.

reply
initramfs 4 hours ago
I think the usage of the word in the CNN article is more like a news report saying there was a bear attack. Bears hunt salmon, eat berries and veggies, since they're omnivores. A report is only going to be typically referring to bears in reference to an attack on humans, but bears have other normal activities, like communing with other bears, taking a nap, raising cubs and going on walks. In that sense, hackers do partake in multiple, non attack activities.

It would be just as unusual to have a story about hackers doing acts of good will, like helping old ladies cross the street. But a news report isn't going to cover that. "Hacker altruist volunteers at soup kitchen" might make a headline, I suppose.

reply
throwaway81523 9 hours ago
There was a Larry Niven story where if you tried to call a certain guy, every phone in South America would ring instead. Anyone remember which story it was? The phone thing was just a throwaway line, not a significant plot point.
reply
p0w3n3d 9 hours ago
It might have been the Ringworld

"Well?"Nessus began to pace the floor. "Many disqualify themselves by obvious bad luck. Of the rest, none seem to be available. When we call, they are out. When we call back, the phone computer gives us a bad connection. When we ask for any member of the Brandt family, every phone in South America rings. There have been complaints. It is very frustrating."

https://www.naneahoffman.com/the-blog/shelf-care-alien-archi...

reply
jagged-chisel 8 hours ago
“ When we ask for any member of the Brandt family, every phone in South America rings.”

That sounds like the computer had a bad solution to “find a Brandt.”

The comment with the request to find this reference had me thinking it would be a single phone number misconfigured to call a large population.

reply
Loughla 6 hours ago
It actually had nothing to do with a computer!

It was the luck of either Teela Brown, or Mr. Brandt depending on how you read the genetic trait of luck.

If you haven't read ringworld, you should. It's really quite good.

But stop before you get to ringworld's children or whatever it's called. Niven's furry fetish is in full force later in the series.

reply
SequoiaHope 6 hours ago
Furry fetish you say? Stop you say? Hmm…
reply
shagie 9 hours ago
Ringworld. https://sciencemeetsfiction.com/2021/06/20/ringworld-theory-...

    “When we call, they are out. When we call back, the phone computer gives us a bad connection. When we ask for any member of the Brandt family, every phone in South America rings.”
reply
p0w3n3d 9 hours ago
TBH phones in Poland allow to call you "from" an arbitrary number (i.e. display it on your phone). Also send SMS with arbitrary source.

This is being used by scammers who call you and tell they are from police bank etc

reply
lxgr 8 hours ago
This works in many countries, since the signalling protocols historically assumed a trusted small set of participants, not unlike email – with similar consequences once those assumptions became less and less true.
reply
allthetime 4 hours ago
I constantly get scam calls from numbers that are very similar to my own in Canada. I assume this is an attempt to look like a normal trustworthy number.
reply
baconhigh 6 hours ago
it’s common for cheap esim providers to route data etc through cheaper data exits, i imagine this is partly why.

(I recently purchased an esim and was surprised to see it exiting poland instead of the country the mobile provider (Bell) resides in)

reply
kakacik 8 hours ago
I've worked a bit on the app which calls major telco provider directly. It was a basic web service call, and sender could be entered as anything. This is basic property of cellular networks, no more safety than say standard email.
reply
mseepgood 9 hours ago
Of all the messages they could have sent they chose the most boring.
reply
neko_ranger 9 hours ago
lets play a game HN, what would be the best alert to send?

mine would be something scifi, like "ALIENS HAVE LANDED" or "PLUTO DECLARES WAR"

reply
tetha 9 hours ago
The world needs more confusing positivity.

"You are beautiful and wonderful - keep going! (unlike this systems security)"

reply
falcor84 8 hours ago
Keep on keeping on.
reply
danillonunes 5 hours ago
Not a message, but a date. There's this huge national exam called ENEM that is like SAT that every Brazilian in age to enter a college takes. Millions of students are taking it every year at the same date and time, as its result is what determines who enters in the best universities. Obviously, security against cheating is a huge concern and so everyone must have their phones turned off and sealed in a bag that stays in front of the class until they finish the exam. Now I can only imagine the chaos that would be if an alert was sent in that day.
reply
michaeljx 9 hours ago
METEOR STRIKE IN 8 MINUTES
reply
Z0rp 9 hours ago
DONT BELIEVE THEM
reply
worble 9 hours ago
Any of the Sims 1 prank phone calls would be amazing
reply
loloquwowndueo 8 hours ago
ALL YOUR BASE ARE BELONG TO US
reply
crtasm 8 hours ago
Tom has added you as a friend!
reply
Kyselica 9 hours ago
“BRAZIL ELIMINATED FROM WORLD CUP”
reply
paulddraper 3 hours ago
BRAZIL DISQUALIFIED FRKM WORLD CUP
reply
munchler 7 hours ago
This would create more chaos than any other suggestion so far. Well done.
reply
danillonunes 6 hours ago
Wouldn't. There isn't a single Brazilian who doesn't know Brazil's current world cup status. The entire country stops when there's a game. Nobody would fall for that.
reply
mckirk 9 hours ago
"THERE IS ABSOLUTELY NO CAUSE FOR ALARM"
reply
peddling-brink 9 hours ago
“DO NOT LOOK AT THE MOON”
reply
lysace 9 hours ago
Most dangerous one:

"This is Army Commander Tomás Miguel Ribeiro Paiva. We have chosen to take command of the country to protect you against serious crimes against the people that we have become aware of. Remain calm and continue with your daily duties."

(Except in Brazilian Portuguese.)

reply
marcosdumay 8 hours ago
Scary stuff.

I guess so scary that there isn't a single person willing to try it. But yeah, that is the most dangerous one possible.

reply
byte_0 8 hours ago
Wake up, Neo...
reply
zarflax 7 hours ago
"Help I'm trapped in a broadcast center"
reply
shagie 9 hours ago
I got a new job! from seank
reply
auggierose 9 hours ago
The truth is out there!
reply
cURLSagan 9 hours ago
THE DISPLAY IS A LIE
reply
vitorgrs 6 hours ago
US/Trump nuclear attack would make people freak here in Brazil.
reply
tedk-42 9 hours ago
ARGENTINA IS BETTER THAN BRAZIL
reply
themafia 9 hours ago
"ALL DEBTS HAVE BEEN ERASED. JUBILEE."
reply
harrisoned 9 hours ago
"PIX will be discontinued today"
reply
paulddraper 8 hours ago
FOLLOW THE WHITE RABBIT
reply
stavros 8 hours ago
"Due to deteriorating economic conditions, we have decided to abolish currency altogether. The Real is now worth nothing. All trade will henceforth be performed exclusively in gold."
reply
morkalork 7 hours ago
This is not a test. This is your emergency broadcast system announcing the commencement of the Annual Purge. Any and all crime, including murder, will be legal for 12 continuous hours.
reply
spacebacon 8 hours ago
[dead]
reply
AlienRobot 9 hours ago
At least it wasn't a crypto scam.
reply
knuppar 8 hours ago
misantropia é um perigo rapaziada
reply
hei-lima 6 hours ago
Suddenly "caralho"!
reply
knuppar 5 hours ago
doideira
reply
luqtas 4 hours ago
porra
reply
thecaio 2 hours ago
[dead]
reply
jpablo 8 hours ago
The power to send mass messages to a whole country is the worst thing google/apple have given to governments across the world.
reply
woodruffw 8 hours ago
This implies that governments didn’t already have this ability, which appears to be largely untrue? To my understanding, many countries already had emergency messaging systems, and mobile integrations are just a way of modernizing them.

(It seems exceedingly good that the government can warn every civilian about natural disasters, etc.)

reply
fc417fc802 4 hours ago
Governments had poorly thought out poorly secured barely functional systems involving the network operators and those were then integrated with default system apps that have terrible UX without fixing any of the problems AFAICT. Agreed that it's clearly necessary functionality but it's worse than useless when it's so far proven to be (at absolute best) a constant stream of irrelevant alarms.
reply
murderfs 8 hours ago
These aren't from Google or Apple, they're from the wireless providers: https://en.wikipedia.org/wiki/Cell_Broadcast
reply
vitorgrs 6 hours ago
This is not related to Google or Apple. And this extreme alert, it's sent even to cable TV automatically. In a few countries, it's sent even on Fax lines.
reply
alpinisme 6 hours ago
If you say so. In the meantime I’ll continue to appreciate the occasional tornado warning.
reply
fc417fc802 4 hours ago
I've yet to receive one of those that was useful. Meanwhile the 70+ year old storm sirens mounted on the nearby office buildings work perfectly in my experience, being audible even indoors from many miles away.
reply
drivers99 3 hours ago
Even then. During a recent storm, they went off erroneously in Denver. (Looks like the other two erroneous alerts were via phone though.)

> Denver emergency officials say they are working to rebuild public trust after a mistaken tornado siren activation Monday became the third improper emergency alert issued in the city this year.

https://www.cbsnews.com/colorado/news/denver-tornado-alarms-...

reply
antonvs 6 hours ago
Where do AI-based military target selection systems fit in your ranking?
reply