Victor Gevers Profile picture
Feb 13, 2019 39 tweets 15 min read Read on X
There is this company in China named SenseNets. They make artificial intelligence-based security software systems for face recognition, crowd analysis, and personal verification. And their business IP and millions of records of people tracking data is fully accessible to anyone. Image
This database contains over 2.565.724 records of people with personal information like ID card number (issue & expire date, sex, nation, address, birthday, passphoto, employer and which locations with trackers they have passed in the last 24 hours which is about 6.680.348 records
The database is now "protected" with a firewall rule. Although the suspicion is that all traffic from outside China is blocked for this service. At least the data is not to access the data anymore for outlanders. Image
In the process of tracking down each tracker, we even stumbled upon abandon locations (according to Google maps). If there is anyone living or working in Keriya who can confirm this location? We also would like to a photo of the device. Image
These are the trackers which are connected the SenseNets database. They make part of this artificial intelligence-based security network which uses face recognition, crowd analysis, and personal verification.

mapmakerapp.com/?map=5c66817e4…


Image
Image
Image
Jeffers got a little bit lost in translation here but does this guy really say: ”details are basically not a problem.”?

And no one is going to sell this database ”on the dark web” because it was given away for free for more than a half year.

popyard.com/cgi-mod/newspa…
Image
This is small overview of the nationalities in that database.
And this is the data to make of the graph: plot.ly/~0xDUDE/0
Image
The age of the oldest person is 93. The youngest person with a valid ID number is a girl of the age of 1 year and 5 months. Both have 汉 nationality and no 维吾尔. The youngest person is 9 days old and has no ID number, no nationality, no address and was registered at this loc. Image
The oldest woman with 维吾尔 nationality is 88 years old and was last seen by a tracker on 31-01-2019 at 17:57:44

The youngest woman with 维吾尔 nationality and without a valid ID number is a 22 days old infant and was last seen on 13-02-2019 at 10:21:19 on this location. Image
There are 301.214 维吾尔 women with an average age of 32 and
424.590 维吾尔 men with an average age of 30 being tracked.
Between 2018 and 2019 about 2,280 people from 俄罗斯 🇷🇺 have visited over 1,113 unique locations in the Yunnan, Sichuan, Shandong, Guangdong, Guangxi, Jiangsu, Hebei, Hubei, Fujian and Liaoning province while being tracked. Image
Around the same time all the database of SenseNets were exposed to the internet the developers starting pushing code to Github sharing their internal passwords, but also their emailaccounts & other credentials online services were shared readable to world on this famous platform. Image
But even with that confidential information publicly exposed there is no technical knowledge needed to control these cameras. The instructions for these things are also on Github. And this why you should NEVER trust technology because the people behind IT can be ignorant idIOTs. Image
It has been 22 days after our initial report about the SenseNets incident. I decided to start investigating the strategic & technical partners from Silicon Valley that contribute to "face recognition" part of this system. Within a few days, I'm going to share some new insights.
The company 微软 also known as @Microsoft has been a precious partner who has turned more than once a blind eye to the (technical)/(mal)practices of the engineers of SenseNets. From pirated versions of Windows servers to offering Azure Cognitive services for Face (recognition). Image
And this is not the first time @Microsoft was called out not to sell @Azure cognitive services to provide a face surveillance product to governments.

"To take an ethical stand, and put children and families above profits”

hrw.org/news/2019/01/1…
After SenseNets became news the API key for cognitive services suddenly disappeared from @Github. But other sensitive materials were still leaked by the developers through their personal repos like e-mail, database, SSH and Gitlab credentials, where the lost API key was found.

Image
Image
Image
At this moment it is not clear if the @Microsoft @Azure Cognitive services are still being used. The developers of SenseNets did not learn much from the previous incident and keep pushing new code and credentials to @Github for their new "Face device management system". 🤦‍♂️🤷‍♂️

Image
Image
Image
The SenseNets case shortly reviewed on an episode off @ChinaUncensored
You should watch the entire video but here the part with some interesting observations made by the host.
"Protecting democratic freedoms and human rights" is a paragraph of the blog post titled "Facial recognition: It’s time for action" by @Microsoft President @BradSmi where he describes the risk of mass surveillance can encroach on democratic freedoms. 🤷‍♂️ blogs.microsoft.com/on-the-issues/…
Image
Xinjiang Dispatch. How China Turned a City Into a Prison
A surveillance state reaches new heights.

By Chris Buckley (@ChuBailiang ), Paul Mozur (@paulmozur) and Austin Ramzy (@austinramz)

nyti.ms/2I3Rkr5
Image
Microsoft has been working with a Chinese military-run university on artificial intelligence research that could be used for surveillance and censorship. The government is using these technologies to build surveillance systems and to detain minorities.

irishtimes.com/business/techn…
Microsoft accused of complicity in human rights abuses after helping China develop ‘disturbing’ AI. >>

As long they are pushing their code and API keys to public open repositories we can at least keep track of what they are doing.
How Microsoft Helped Build China’s Nightmare Surveillance by @ChinaUncensored
Watch the entire episode here:
A large publicly available facial recognition dataset with 10 million images of nearly 100,000 individuals known as "Face Model Zoo" was created and maintained by Microsoft is now offline. This is how it went down.
There are a lot of (large) data facial recognition datasets publicly available like fopr example CelebA on Kaggle which contains 202.599 face images of various celebrities / 10177 unique identities. Image
SenseNets used the Duke MTMC dataset was used for "extensive experiments" on improving person re-identification across multiple surveillance cameras with important applications in suspect tracking for "research" and development of video tracking systems.

megapixels.cc/datasets/duke_…
Inside China's 'thought transformation' camps by @TheJohnSudworth of the @BBCNews

The BBC has been given rare access to the vast system of highly secure facilities thought to be holding more than a million Muslims in China’s western region of Xinjiang.

Chinese ”education” camps in the northwest Xinjiang region of China.

In this video you see up to 600 prisoners (Uighur Muslim men) being moved — they’re shackled together, have shaved heads, are blindfolded and have their hands locked behind their backs.
news.com.au/world/asia/chi…
"To hide mass detentions in Xinjiang, large numbers of detainees are being relocated from the region to other localities: the neighboring province of Gansu and more distant places, like Henan Province in central China."

bitterwinter.org/xinjiang-camp-…
Around these re-education camps, they use security systems which are set up specifically to recognize Uyghurs using facial recognition from unprotected live video feeds. These systems were open and accessible to the entire world.
Image
Image
Another (never shared and) remarkable thing is that SenseNets was experimenting/doing something with network cameras which showed live views of (de)construction sites [locations unknown]. We never could find any connection besides the fact that the IPs were in the MySQL database. Image
@github @Microsoft @gitlab This is the unmasked Ocp-Apim-Subscription-Key "1319e7ff63901002c1ff5b02e46b5a77". We never got it working when we found it, and it still does not work today. Image
Yesterday Belnet (AS2611) was under a DDoS attack and downed the Belgium government's network and other govt and educational entities when the Belgium Parliament was supposed to hear the testimony of a survivor of China's “re-education” camps. 巧合?
@threadreaderapp unroll

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Victor Gevers

Victor Gevers Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @0xDUDE

Jul 4, 2020
I have been looking around in the @parler_app and within the Parler platform. The app lacks basic security like certificate pinning. This makes it easy to take a look under the hood. Most of the accounts are marked as: "human": false". ImageImage
To be able to become human in the Parler, you need to get verified. Users can do this by scanning their U.S. drivers license or Passport within the app. I tried a few times with my Dutch Passport but this failed. Even Parlersupport couldn’t help. So I searched for another way. ImageImageImage
So Parler advertises to be an unbiased social media focused on real user experiences and engagement
I appreciate projects which enable free speech. On Parler, it seems that many celebrities are not 'human'. Most accounts are not verified. But even the verified ones are not human? Image
Read 4 tweets
Oct 3, 2019
There is this Beijing-based Artificial Intelligence company known as Pensees Technology. They build passwordless, rinky-dink, AI-based security software systems using face recognition, and crowd analysis, which can detect a specific ethnic group from photos and video streams. 🤷🏻‍♂️
Peensees products are used for security applications and use existing face recognition technologies and CCTV cameras. This is a (mockup) dashboard of their open AI R&D environment. It looks like a "SenseNets disaster 2.0" in the making as they have no clue what they are doing. 🤦‍♂️
The issue with these experimental R&D AI/FRT projects is that they use real production systems and data. Realtime security footage from governmental buildings and actual police data sets used in open systems grating access to active third party mass surveillance systems in China.
Read 4 tweets
Mar 2, 2019
Can anyone (from China) identify these Messaging services?

imsg <--...
qg <--...
qqmesg. <--
wwmsg <--...
wxmsg <--...
yymsg <--...

In China, they have a surveillance program on social networks which looks like a jerry-rigged PRISM clone of the NSA.imqq.com
So this social media surveillance program is retrieving (private) messages per province from 6 social platforms and extracts named, ID numbers, ID photos, GPS locations, network information, and all the conversations and file transfers get imported into a large online database.
Around 364 million online profiles and their chats & file transfers get processed daily. Then these accounts get linked to a real ID/person. The data is then distributed over police stations per city/province to separate operators databases with the same surveillance network name
Read 33 tweets
Jan 27, 2019
Responsible disclosure #4155 took 3 years, 5 months and 15 days to fix the after effect of the leaked credentials. Some breaches don't have to be big in size (as in the number of records which are exposed) to have a significant impact which can take years to fix. [1/2]
Until recently many 🇷🇺 companies were using MongoDB not securely.
Most of them are reported to the owners. The biggest issue was that @KremlinRussia_E requires remote access to businesses and used the same credentials everywhere as we found them in the thousands of open databases
One of these open databases w these Kremlin credentials was a MongoDB server holding ERDR information by @MVS_UA (RD#5019) which shows that changing a password in a system (where they had remote access) in a country with who how they are in a war with was too much effort for 🇷🇺
Read 6 tweets
Feb 11, 2018
Looking for 0xDEADFEED to find 0x8BADF00D that went 0xBAAAAAAD.
Maybe it needs to 0xC00010FF to escape this 0xDEAD10CC situation?
Still hunting for unicorns but I only found a pony till now.
Oh I see that @Zeecka_ already found the pony : :-D
"optional, backdoor for tweaking UART config" and "Dup Tag Debug Backdoor Ram Access for CP0/CA0". At least Apple named it what it is in the #iBoot source code :-)
Read 6 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(