译者 Majella
Manipulating social networks
操控社会网络
在这里输入译文
In Syria and Iran, among other places, social media users are lulled into a dangerously false sense of security.
在叙利亚和伊朗，以及其他许多地方，社会媒体用户容易陷入危险的安全错觉。
If there’s one thing that net-savvy activists from Tunisia to Bahrain are aware of, it’s that the Internet isn’t always safe. From the constant threat of surveillance to the knowledge that posting the wrong picture on Facebook can get you arrested – or worse – activists have for a long time taken measures to mitigate risks, censoring themselves, using special tools like Tor, or staying off certain networks altogether.
如果从突尼斯到巴林岛，聪明的网络活跃者们注意到一件事，即网络不总是安全的。从长期的监控威胁到了解在Facebook 上乱挂照片会惹来牢狱之灾甚至更惨的后果，网络活跃者们一直以来都在采取措施减少风险，比如检查自己，使用特殊工具（如Tor），或者远离某些网络。
Unfortunately, not only do some activists lack the necessary savvy, but even the best can fall victim to savvier regimes. Back in December, for example, just as the Tunisian uprising began to take root, activists within the country noticed that their Facebook accounts had been compromised. Some reported information missing from their accounts, leading Facebook to investigate and, in the end, re-route users to a secure HTTPS version of the site.
不幸的是，一些网络用户不仅缺乏必要常识，而且最好的网络用户也成为更加聪明的政权的受害者。例如，回到12月份，就在突尼斯起义刚刚开始时，本国的网络活跃者发现他们的Facebook账户已经遭到危害。一些报道称信息从账户上流失，导致Facebook接受调查，最终使用户改道使用安全的HTTPS版网站。
The incident may have prompted Facebook to make the decision to roll out HTTPS to all of its users. By the end of February, users of the site could opt in for increased security; but as two incidents from this week illustrate, their sense of security may have been premature. The latest in a series of events to take advantage of Facebooking dissidents, the two exploits demonstrate a seemingly perpetual cat-and-mouse game between users of social media living under authoritarian regimes and the regimes themselves.
这件事可能促使Facebook决定向所有用户推出HTTPS。2月底，该网站的用户为了提高安全而决定使用HTTPS，但是本周的两件事表明，他们的安全感可能有些早熟。利用Facebook查出异己分子的系列事件中，最近这两件事演示了活在当局政权下的社会媒体用户与政权本身之间似乎永不停歇的猫捉老鼠的游戏。
Syrian Facebookers targeted
对准叙利亚Facebook用户
For months, the Syrian regime and its supporters have been devising and implementing new ways of targeting social media users who express favour toward the opposition, from flooding Twitter hashtags with unrelated links to hacking and defacing opposition sites. While various incidences of Facebook manipulation have been reported, none have been confirmed.
几个月来，叙利亚政权和其支持者一直在设计和实施新的方式对付那些亲近反对派的社会媒体用户，汹涌而来的Twitter关键词链接着不相关的黑掉和涂掉反对派网站的内容。当Facebook操作发生各种事件相继报出时，没有哪一件得到证实。
Today, the Information Warfare Monitor reports on a new attempt to mount an attack on pro-opposition Syrians. Though the perpetrators remain unknown, the attacks were launched on Twitter, targeting users of Facebook. According to the report, the culprits tweeted a link in an attempt to lure followers to a video posted to Facebook, whereupon those clicking on the link would be redirected to a fake Facebook page. Then, if the user then logged in, their credentials would be captured and their account information compromised.
今天，信息战事管理报道发动对前叙利亚反对派的新一轮进攻。尽管罪人尚不可知，Twitter上已经开始进攻，目标正是Facebook用户。根据这篇报道，罪犯发微博链接想要使追随者观看Facebook上的一段视频，而点击这条链接进入的却是假Facebook页面。因此，一旦用户登录，他们的证件就会被盗，账户信息也会受到危害。
This type of attack, whether launched by the regime or third-party actors, is basic in scope but can be devastating to a user who hasn’t backed up his or her Facebook data (a feature made available in the Account Settings), and outright dangerous to an activist whose account contains private information or sensitive contacts. Still, this type of attack pales in comparison to one discovered this week in neighbouring Iran.
这种袭击不管是由政权发起还是第三方参与者，范围尚且不广，但可能会给不支持Facebook数据的用户造成巨大伤害，而且直接危害到那些账户包含私人信息和敏感接触记录的网络用户。而且，这种袭击比起本周在伊朗附近发现的另一种袭击已是相形见绌。
Iranian connection
伊朗关系
In the wake of the Arab Spring and the development of tools like Firesheep, escalating risks have led to increased pressure on social media platforms to offer encrypted HTTPS connections to their sites, providing users with a safer, less vulnerable way of accessing their platforms. In the wake of the aforementioned Tunisian attack, Facebook rolled out opt-in encryption services to its users, while Twitter is in the early stages of offering it by default (it’s already available as an opt-in service). Most webmail programmes offer secure browsing as well.
当阿拉伯革命爆发，以及诸如火羊等工具开发出来时，日益升级的风险已经导致社会媒体平台面对越来越大的压力去提供加密的HTTPS链接到原本的网址，为用户提供更安全更强大的接近平台的方式。在之前提到的突尼斯袭击爆发时，Facebook为用户铺开了加密服务，而Twitter进入了默认提供加密服务的早期阶段（这已成为可用的服务了）。大部分网络邮件系统也提供了安全搜索。
When a user visits such sites, they are relying upon Certificate Authorities (CAs), hundreds of companies that sign the certificates that supposedly guarantee secure browsing. But what happens if just one of these CAs is tricked into issuing a fraudulent certificate? That certificate can be used to compromise sites that people believe they are browsing securely.
当用户访问这样的网址，他们依赖认证权威（CA），这是数百个公司签署的证书来保证安全浏览。但是如果有一个CA签发了一个错误认证，那会发生什么事呢？这个认证可能会用于危害人们自认为是安全浏览的网站。
On Monday, an Iranian Gmail user reported a warning from the Google Chrome browser that indicated the presence of a fake certificate. A statement from Google acknowledges that primarily Iranian users were affected, and that the fraudulent certificate was issued by a CA called DigiNotar nearly two months ago, on July 10. While critics of the CA system have long feared that such an attack could be possible, this is the first time such an attack has been seen “in the wild”.
星期一，一位谷歌邮件的伊朗用户称收到来自谷歌Chrome浏览器的警告，该警告暗示出现假认证。谷歌发出的声明承认早前伊朗用户受到了影响，这份错误认证是在大约两个月前的7月10日由名叫DigiNotar的CA签发。虽然CA系统的批评者们一直担心这样的袭击会出现，这却是第一次在网络上看到这样的袭击。
For the last two months, Iranians who tried to access encrypted Google websites, including Gmail, may have been vulnerable to surveillance, their user data (including passwords and any activity conducted while logged into a site) available to the attacker.
过去两个月里，试图进入保密的谷歌网站包括谷歌邮件的伊朗人可能容易遭到监管，袭击者很容易获得他们的用户数据（包括密码和任何一旦登录进入网站后执行的操作）。
For its part, Google has released a statement reminding users to be vigilant about keeping software up-to-date and pay attention to browser warnings. Mozilla, which produces the Firefox browser, and Microsoft have communicated the situation to users as well.
对此，谷歌发出声明提醒用户要谨慎地保持软件升级，注意浏览器警告。推出火狐浏览器的Mozilla以及微软也已经对此和用户进行交流。
Different methods, same purpose
殊途同归
Although the Iranian attack was significantly more sophisticated than that perpetrated against Syrian Facebook users, both serve the same ends: to grab hold of user data in an attempt by malicious actors to silence or endanger those with whom they disagree.
虽然伊朗的袭击比起针对叙利亚Facebook用户的犯事更为复杂得多，但两者都达到了同样的结果：恶意网络用户获取用户数据，以屏蔽或威胁异己分子。
Syrian authorities have used the Facebook accounts of detainees, for example, to track down other activists. The same has occurred in Bahrain, while in Iran, deep packet inspection – used to snoop on email, VoIP calls, and other online activity – has been reported. Activists in all three countries have been arrested, jailed, and in some cases, tortured.
叙利亚当局已使用Facebook账户，来追踪其他网络用户。巴林岛也出现了相同事件，而在伊朗已经报道出深度数据包检查，它是用于窥探邮件，重要电话和其他网上活动。在这三个国家的网络用户都已经被拘捕，关押，某些还遭到了酷刑拷问。
Critics of the encryption and CA systems have long focused on the threats to average users. The Electronic Frontier Foundation (where I am employed) has voiced concerns that such incidents may be widespread, noting that the CA system was created decades ago, “in an era when the biggest online security concern was thought to be protecting users from having their credit card numbers intercepted”.
对加密和CA系统持批评态度的人们一直都强调普通用户受到的威胁。电子边境地基公司（我工作的公司）担心袭击事件可能会蔓延，它注意到CA系统是几十年前创立，那时人们认为最大的网络安全忧患是保护用户的信用卡账号不被破译。
These latest attacks shed light on just how serious the ramifications can be for users in countries like Iran and Syria, where authorities regularly use social media to silence dissenters. When a regime gains the capability to conduct surveillance on large swaths of users, it need not rely on traditional, cost-heavy methods of identifying and spying on individuals.
而最近的袭击事件表明在像伊朗和叙利亚这样的国家，对用户来说这样的事件后果多么严重，这些国家的政府当局定期使用社会媒体消除异己之音。当政权获得了大部分用户的监管能力，它就不需要依靠传统的高成本的定位并监视个体的办法了。
It is therefore imperative that the security community, and the Certificate Authorities in particular, become aware of the global implications of their technologies: there are lives at stake.
因此，安全社团尤其是认证权威要认识到他们的技术对全球的寓意：有生命处于危险之中，这一点迫在眉睫。
Jillian York is director for International Freedom of Expression at the Electronic Frontier Foundation in San Francisco. She writes a regular column for Al Jazeera focusing on free expression and Internet freedom. She also writes for and is on the Board of Directors of Global Voices Online.
Jillian York是洛杉矶电子边境地基公司国际言论自由部门的主人。她为阿拉伯半岛新闻电视台提供关于自由言论和网络自由的专栏稿件。她也为全球之声网络董事会撰文，同时也是其中一员。
The views expressed in this article are the author’s own and do not necessarily reflect Al Jazeera’s editorial policy.
本文纯属作者个人观点，不代表阿拉伯半岛新闻电视台。
本文由自动聚合程序取自网络，内容和观点不代表数字时代立场
