ReportWire

Tag: Cybersecurity

  • We’re bending our investment rules and starting positions in 2 of our Bullpen stocks

    We’re bending our investment rules and starting positions in 2 of our Bullpen stocks

    [ad_1]

    [ad_2]

    Source link

  • Maryland’s ‘bug bounty’ helps detect vulnerabilities on the state’s websites – WTOP News

    Maryland’s ‘bug bounty’ helps detect vulnerabilities on the state’s websites – WTOP News

    [ad_1]

    The state of Maryland has unleashed a team of computer experts and enthusiasts on a number of the state’s websites. The mission: to see if they could find weak spots in the state’s websites.

    The state of Maryland has unleashed a team of computer experts and enthusiasts on a number of the state’s websites. The mission: to see if they could find weak spots in the state’s domains that end in “maryland.gov,” “us.md.gov” or “state.md.us.”

    “We found more than 40 vulnerabilities,” said Chris Krawiec, senior director of cyber resilience with the Maryland Department of Information Technology.

    When asked about where those weak spots on the state’s websites were found, Krawiec told WTOP he “can’t speak on specifics on vulnerabilities for security reasons, but what I can say is that largely speaking, all of our agency partners were very responsive.”

    The goal is to plug any holes in security that could present a security risk, including something like “an exposure of resident data,” Krawiec said.

    Krawiec explained that the “bug bounty” method of detecting problems with security on the state’s websites is similar to the model used by federal agencies, where participants are hired to find bugs and are only paid if they do detect them.

    “When we do a bug bounty, it’s a pay-for-performance type style engagement,” he said, where the researchers are not paid unless they find a vulnerability.

    When it comes to the cost of remediation, Krawiec said, “These are generally assets or applications that are already being managed by their state agencies or our partners in this program,” so there’s not typically an extra cost associated with instituting the fixes.

    Krawiec said that the recent study of the state’s cybersecurity status is a first for the state.

    “It is definitely something that we’re considering expanding,” he said.

    The bug bounty approach to scouring the state’s websites is something that’s been used at the federal level, Krawiec told WTOP. And it’s very cost-effective, at about $100,000.

    “From a cost perspective,” Krawiec said, “that’s testing almost the entirety of the public-facing infrastructure of the state for $100,000.”

    Get breaking news and daily headlines delivered to your email inbox by signing up here.

    © 2024 WTOP. All Rights Reserved. This website is not intended for users located within the European Economic Area.

    [ad_2]

    Kate Ryan

    Source link

  • It Seemed Like an AI Crime-Fighting Super Tool. Then Defense Attorneys Started Asking Questions

    It Seemed Like an AI Crime-Fighting Super Tool. Then Defense Attorneys Started Asking Questions

    [ad_1]

    In 2017, then 9-year-old Kayla Unbehaun was abducted. For years, the South Elgin, Illinois police department searched for Unbehaun and her noncustodial mother, Heather Unbehaun, who was accused of the abduction, following her trail to Georgia, where they hit a dead end. During that time, the department signed a contract with Global Intelligence, and sergeant Dan Eichholz received a Cybercheck report that placed Unbehaun and her mother in Oregon, he tells WIRED. It was a new lead, but because Cybercheck didn’t provide any evidence to support its findings, Eichholz couldn’t use the report to obtain a search warrant.

    Unbehaun was finally reunited with her father in 2023, after an employee at a consignment shop in Asheville, North Carolina, recognized her mother from a picture shown on the Netflix show Unsolved Mysteries. After Unbehaun was located, Eichholz learned during the follow-up investigation that, until several months earlier, the pair had indeed been living in Oregon.

    “I don’t want to say it wasn’t actionable, but I couldn’t just take their information and go with it,” Eichholz says. “That was always the hang-up for us. ‘OK, you got me this information, but I still have to check and verify and do my thing with search warrants.’” The child abduction case against Heather Unbehaun is ongoing.

    Any Help They Can Get

    Cybercheck has spread to law enforcement agencies across the country thanks to generous marketing offers and word-of-mouth recommendations. But in interviews with WIRED and the email exchanges we examined, there was little evidence that law enforcement agencies sought or received evidence to support Global Intelligence’s claims about what its technology could do.

    Prosecutors who spoke to WIRED, such as Borden from Midland County, say they learned about Cybercheck because law enforcement in their jurisdiction had been using it. And when it came up in a case, they let the adversarial court system decide whether or not it was legitimate.

    “It was new technology and I was curious, so I was like, ‘Let’s give it a try and see how far we can get,’” Borden says. “I’m thankful that it didn’t come into evidence in my case, that I didn’t need it to get my conviction.”

    Emails show Global Intelligence sales representatives regularly offered to run police departments’ cases through Cybercheck for free in order to demonstrate the technology. They also referenced cases that Global Intelligence characterized as high profile and that Cybercheck supposedly helped solve, without naming the cases outright or providing evidence that Cybercheck had made any difference in the investigations.

    Emails obtained by WIRED from the Ohio Bureau of Criminal Investigation show that investigators were initially excited to see what information Cybercheck could provide about their cold cases. They even introduced Global Intelligence sales representatives to other law enforcement agencies in Ohio. That enthusiasm seems to have helped convince other agencies to trust the company.

    Gessner, from the Summit County Prosecutor’s office, says that when his agency was deciding whether to use Cybercheck evidence, it asked the Ohio BCI’s cybercrimes unit for an opinion. “They said, yes, it makes sense … we don’t have the technology to do this, but we’d love to have it.” County prosecutors also reached out to the SANS Institute, he says, and were told the institute didn’t “do this type of stuff.”

    But even as it has withdrawn evidence that Cybercheck provided, Gessner says the Summit County Prosecutor’s Office is asking other companies whether they can do the same kind of open source locating that Global Intelligence marketed.

    “We don’t want to shut doors that can help point to the truth in our cases,” he says.

    [ad_2]

    Todd Feathers

    Source link

  • SOFTwarfare Unveils Revolutionary Zero Trust Identity Solution for JADC2 at AUSA 2024

    SOFTwarfare Unveils Revolutionary Zero Trust Identity Solution for JADC2 at AUSA 2024

    [ad_1]

    Press Release
    •

    Oct 14, 2024

    Securing the Future of Defense with Air-Gapped, Multimodal Authentication, Tactical and OT Access Control


    WASHINGTON, October 14, 2024 (Newswire.com)
    –
    SOFTwarfare, a global leader in Zero Trust Identity solutions, today announced at the Association of the United States Army (AUSA) Annual Meeting & Exposition a groundbreaking advancement in its Zero Trust Identity® platforms. This latest iteration is specifically designed to meet the stringent authentication and Identity, Credential, and Access Management (ICAM) requirements of Department of Defense (DoD) deployments within a Joint All-Domain Command and Control (JADC2) environment.

    This announcement builds upon SOFTwarfare’s Spring announcement bringing Zero Trust Identity to market for enterprise and private sector customers to meet the growing needs around CMMC and signifies a major leap forward in secure access for critical defense operations. SOFTwarfare’s Zero Trust Identity® platform now provides:

    • Unparalleled Security for JADC2: Ensures secure, authenticated access to sensitive data and resources within the complex and dynamic JADC2 architecture.
    • Enhanced ICAM Capabilities: Meets the rigorous identity and access management demands of modern military operations with advanced multi-factor authentication and authorization.
    • Seamless Integration: Deploys smoothly within existing DoD infrastructure and integrates with leading endpoint security solutions.

    “This is a pivotal moment for SOFTwarfare,” said Wyatt Cobb, CEO of SOFTwarfare. “Our Zero Trust Identity® platform not only fortifies JADC2 security but also provides the foundation for a new era of secure access across the DoD.”

    SOFTwarfare is already a trusted provider of Zero Trust Identity® solutions for operational technology (OT) environments within leading commercial enterprises and critical infrastructure sectors. This proven success, combined with the platform’s new JADC2 capabilities, positions SOFTwarfare as a key enabler of secure and resilient defense operations.

    “We are deeply committed to delivering innovative cybersecurity solutions that protect our nation’s most critical assets,” said Wyatt Cobb, CEO of SOFTwarfare. “This advancement for JADC2 is a testament to our dedication to supporting the DoD’s mission and ensuring the highest levels of security for our warfighters.”

    Key Features & Benefits:

    • Multimodal Biometric Authentication for Enterprise Applications: Proprietary technology that utilizes multiple biometric factors for strong identity verification across a wide range of enterprise applications, including access to sensitive data, critical systems, and secure facilities.
    • Operational Technology Access Control: Granular control over access to critical OT systems, preventing unauthorized access and mitigating the risk of cyberattacks on industrial control systems and other vital infrastructure.
    • User and Entity Behavioral Analytics (UEBA): Real-time risk assessment based on user behavior and network activity.
    • Automated and Human-in-the-Loop Decision Making: Provides both automated responses and human oversight for optimal security.
    • Cloud, Hybrid, and Air-Gapped Deployments: Flexible deployment options to meet the unique needs of various DoD environments.
    • Rapid Integration with Leading Endpoint Sensors: Ensures comprehensive security across all devices and access points.

    SOFTwarfare continues to be at the forefront of cybersecurity innovation, providing enterprise-grade platforms that meet the evolving needs of both commercial and defense sectors. With this latest release, SOFTwarfare solidifies its position as the global leader in Zero Trust Identity, empowering organizations to defend against increasingly sophisticated cyber threats.

    About SOFTwarfare

    SOFTwarfare is a global cybersecurity software company that defends assets from cyberattacks by securing mission-critical integrations and users. They deliver a secure Integration Platform-as-a-Service (iPaaS) and next-generation biometric multi-factor authentication (MFA). Learn more at softwarfare.com.  

    Source: SOFTwarfare

    [ad_2]

    Source link

  • The War on Passwords Is One Step Closer to Being Over

    The War on Passwords Is One Step Closer to Being Over

    [ad_1]

    The password-killing tech known as “passkeys” have proliferated over the past two years, developed by the tech industry association known as the FIDO Alliance as an easier and more secure authentication alternative. And although superseding any technology as entrenched as passwords is difficult, new features and resources launching this week are pushing passkeys toward a tipping point.

    At the FIDO Alliance’s Authenticate Conference in Carlsbad, California, on Monday, researchers are announcing two projects that will make passkeys easier for organizations to offer—and easier for everyone to use. One is a new technical specification called Credential Exchange Protocol (CXP) that will make passkeys portable between digital ecosystems, a feature that users have increasingly demanded. The other is a website, called Passkey Central, where developers and system administrators can find resources like metrics and implementation guides that make it easier to add support for passkeys on existing digital platforms.

    “To me, both announcements are part of the broader story of the industry working together to stop our dependence on passwords,” Andrew Shikiar, CEO of the FIDO Alliance, told WIRED ahead of Monday’s announcements. “And when it comes to CXP, we have all these companies who are fierce competitors willing to collaborate on credential exchange.”

    CXP comprises a set of draft specifications developed by the FIDO Alliance’s “Credential Provider Special Interest Group.” Development of technical standards can often be a fraught bureaucratic process, but the creation of CXP seems to have been positive and collaborative. Researchers from the password managers 1Password, Bitwarden, Dashlane, NordPass, and Enpass all worked on CXP, as did those from the identity providers Okta as well as Apple, Google, Microsoft, Samsung, and SK Telecom.

    The specifications are significant for a few reasons. CXP was created for passkeys and is meant to address a longstanding criticism that passkeys could contribute to user lock-in by making it prohibitively difficult for people to move between operating system vendors and types of devices. In many ways, though, this problem already exists with passwords. Export features that allow you to move all of your passwords from one manager to another are often dangerously exposed and essentially just dump a list of all of your passwords into a plaintext file.

    It’s gotten much easier to sync passkeys across your devices through a single password manager, but CXP aims to standardize the technical process for securely transferring them between platforms so users are free—and safe—to roam the digital landscape. Importantly, while CXP was designed with passkeys in mind, it is really a specification that can be adapted to securely exchange other secrets as well, including passwords or other types of data.

    [ad_2]

    Lily Hay Newman

    Source link

  • Pig Butchering Scams Are Going High Tech

    Pig Butchering Scams Are Going High Tech

    [ad_1]

    As digital scamming explodes in Southeast Asia, including so called “pig butchering” investment scams, the United Nations Office on Drugs and Crime (UNODC) issued a comprehensive report this week with a dire warning about the rapid growth of this criminal ecosystem. Many digital scams have traditionally relied on social engineering, or tricking victims into giving away their money willingly, rather than leaning on malware or other highly technical methods. But researchers have increasingly sounded the alarm that scammers are incorporating generative AI content and deepfakes to expand the scale and effectiveness of their operations. And the UN report offers the clearest evidence yet that these high tech tools are turning an already urgent situation into a crisis.

    In addition to buying written scripts to use with potential victims or relying on templates for malicious websites, attackers have increasingly been leaning on generative AI platforms to create communication content in multiple languages and deepfake generators that can create photos or even video of nonexistent people to show victims and enhance verisimilitude. Scammers have also been expanding their use of tools that can drain a victim’s cryptocurrency wallets, have been manipulating transaction records to trick targets into sending cryptocurrency to the wrong places, and are compromising smart contracts to steal cryptocurrency. And in some cases, they’ve been purchasing Elon Musk’s Starlink satellite internet systems to help power their efforts.

    “Agile criminal networks are integrating these new technologies faster than anticipated, driven by new online marketplaces and service providers which have supercharged the illicit service economy,” John Wojcik, a UNODC regional analyst, tells WIRED. “These developments have not only expanded the scope and efficiency of cyber-enabled fraud and cybercrime, but they have also lowered the barriers to entry for criminal networks that previously lacked the technical skills to exploit more sophisticated and profitable methods.”

    For years, China-linked criminals have trafficked people into gigantic compounds in Southeast Asia, where they are often forced to run scams, held against their will, and beaten if they refuse instructions. Around 200,000 people, from at least 60 countries, have been trafficked to compounds largely in Myanmar, Cambodia, and Laos over the last five years. However, as WIRED reporting has shown, these operations are spreading globally—with scamming infrastructure emerging in the Middle East, Eastern Europe, Latin America, and West Africa.

    Most prominently, these organized crime operations have run pig butchering scams, where they build intimate relationships with victims before introducing an “investment opportunity” and asking for money. Criminal organizations may have conned people out of around $75 billion through pig butchering scams. Aside from pig butchering, according to the UN report, criminals across Southeast Asia are also running job scams, law enforcement impersonation, asset recovery scams, virtual kidnappings, sextortion, loan scams, business email compromise, and other illicit schemes. Criminal networks in the region earned up to $37 billion last year, UN officials estimate. Perhaps unsurprisingly, all of this revenue is allowing scammers to expand their operations and diversify, incorporating new infrastructure and technology into their systems in the hope of making them more efficient and brutally effective.

    For example, scammers are often constrained by their language skills and ability to keep up conversations with potentially hundreds of victims at a time in numerous languages and dialects. However, generative AI developments within the last two years—including the launch of writing tools such as ChatGPT—are making it easier for criminals to break down language barriers and create the content needed for scamming.

    [ad_2]

    Matt Burgess, Lily Hay Newman

    Source link

  • Cramer wants to buy more of this chipmaker, considers adding another cybersecurity stock

    Cramer wants to buy more of this chipmaker, considers adding another cybersecurity stock

    [ad_1]

    Every weekday the CNBC Investing Club with Jim Cramer holds a “Morning Meeting” livestream at 10:20 a.m. ET. Here’s a recap of Friday’s key moments.

    [ad_2]

    Source link

  • Scotia explores Google Cloud for cybersecurity solutions

    Scotia explores Google Cloud for cybersecurity solutions

    [ad_1]

    Scotiabank is exploring the use of AI and generative AI to bolster its cybersecurity infrastructure and aims to work with vendors to develop the technology. Google Cloud is in the running to partner on the tech, Louise Dandonneau, vice president of cybersecurity operations, told Bank Automation News.  “We have announced our partnership with Google Cloud, […]

    [ad_2]

    Vaidik Trivedi

    Source link

  • Marriott reaches $52 million settlement over years of data breaches

    Marriott reaches $52 million settlement over years of data breaches

    [ad_1]

    Marriott International is being taken to task after the hotel chain suffered multiple data breaches that exposed sensitive information for more than 344 million customers around the world. First, Marriott agreed to a settlement of with a group of 50 US attorneys general. According to Connecticut Attorney General William Tong, 131.5 million hotel customers in the states had their information compromised in the attacks on the hotels.

    Second, a settlement with the Federal Trade Commission will require Marriott and its Starwood Hotels & Resorts subsidiary to implement a new information security system to protect against future data exposures. The FTC agreement includes measures such as data minimization, account review tools for its loyalty rewards programs and a link for guests to request deletion of their personal information.

    Today’s settlements center on three separate data breaches at Marriott and Starwood between 2014 and 2020 that allowed malicious actors to access passport information, payment card numbers, loyalty numbers, dates of birth, email addresses and other personal information. But cybersecurity issues have been an ongoing concern for these two businesses over the past decade. Hackers used “social engineering techniques” to access an employee computer and steal about . Marriott was also part of a larger attack in 2019. Starwood was victim of discovered in 2018; the company faced a fine of about in the UK for that incident.

    [ad_2]

    Anna Washenko

    Source link

  • Internet Archive Breach Exposes 31 Million Users

    Internet Archive Breach Exposes 31 Million Users

    [ad_1]

    An illicit JavaScript popup on the Internet Archive proclaimed on Wednesday afternoon that the site had suffered a major data breach. Hours later, the organization confirmed the incident.

    Longtime security researcher Troy Hunt, who runs the data breach notification website Have I Been Pwned (HIBP), also confirmed that the breach is legitimate. He said that it occurred in September and the stolen trove contains 31 million unique email addresses along with usernames, bcrypt password hashes, and other system data. Bleeping Computer, which first reported the breach, also confirmed the validity of the data.

    The Internet Archive did not yet return multiple requests for comment from WIRED.

    “Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach?” the attackers wrote in Wednesday’s Internet Archive popup message. “It just happened. See 31 million of you on HIBP!”

    In addition to the breach and site defacement, the Internet Archive has been grappling with a wave of distributed denial-of-service attacks that have intermittently brought down its services.

    Internet Archive founder Brewster Kahle provided a public update on Wednesday evening in a post on the social network X. “What we know: DDOS attack–fended off for now; defacement of our website via JS library; breach of usernames/email/salted-encrypted passwords. What we’ve done: Disabled the JS library, scrubbing systems, upgrading security. Will share more as we know it.” “Scrubbing systems” refer to services that offer DDoS attack protection by filtering malicious junk traffic so it can’t deluge and disrupt a website.

    The Internet Archive has faced aggressive DDoS attacks numerous times in the past, including in late May. As Kahle wrote on Wednesday: “Yesterday’s DDOS attack on @internetarchive repeated today. We are working to bring http://archive.org back online.” The hacktivist group known as “BlackMeta” claimed responsibility for this week’s DDoS attacks and said it plans to carry out more against the Internet Archive. Still, the perpetrator of the data breach is not yet known.

    The Internet Archive has faced battles on many fronts in recent months. In addition to repeated DDoS attacks, the organization is also facing mounting legal challenges. It recently lost an appeal in Hachette v. Internet Archive, a lawsuit brought by book publishers, which argued that its digital lending library violated copyright law. Now, it’s facing an existential threat in the form of another copyright lawsuit, this one from music labels, which may result in damages upwards of $621 million if the court rules against the archive.

    HIBP’s Hunt says that he first received the stolen Internet Archive data on September 30, reviewed it on October 5, and warned the organization about it on October 6. He says the group confirmed the breach to him the next day and that he planned to load the data into HIBP and notify its subscribers about the breach on Wednesday. “They get defaced and DDoS’d, right as the data is loading into HIBP,” Hunt wrote. “The timing on the last point seems to be entirely coincidental.”

    Hunt added, too, that while he encouraged the group to publicly disclose the data breach itself before the HIBP notifications went out, the extenuating circumstances may explain the delay.

    “Obviously I would have liked to see that disclosure much earlier, but understanding how under attack they are, I think everyone should cut them some slack,” Hunt wrote. “They’re a non-profit doing great work and providing a service that so many of us rely heavily on.”

    [ad_2]

    Lily Hay Newman, Kate Knibbs

    Source link

  • Stealthy Malware Has Infected Thousands of Linux Systems for Years

    Stealthy Malware Has Infected Thousands of Linux Systems for Years

    [ad_1]

    Other discussions include: Reddit, Stack Overflow (Spanish), forobeta (Spanish), brainycp (Russian), natnetwork (Indonesian), Proxmox (Deutsch), Camel2243 (Chinese), svrforum (Korean), exabytes, virtualmin, serverfault and many others.

    After exploiting a vulnerability or misconfiguration, the exploit code downloads the main payload from a server, which, in most cases, has been hacked by the attacker and converted into a channel for distributing the malware anonymously. An attack that targeted the researchers’ honeypot named the payload httpd. Once executed, the file copies itself from memory to a new location in the /temp directory, runs it, and then terminates the original process and deletes the downloaded binary.

    Once moved to the /tmp directory, the file executes under a different name, which mimics the name of a known Linux process. The file hosted on the honeypot was named sh. From there, the file establishes a local command-and-control process and attempts to gain root system rights by exploiting CVE-2021-4043, a privilege-escalation vulnerability that was patched in 2021 in Gpac, a widely used open source multimedia framework.

    The malware goes on to copy itself from memory to a handful of other disk locations, once again using names that appear as routine system files. The malware then drops a rootkit, a host of popular Linux utilities that have been modified to serve as rootkits, and the miner. In some cases, the malware also installs software for “proxy-jacking,” the term for surreptitiously routing traffic through the infected machine so the true origin of the data isn’t revealed.

    The researchers continued:

    As part of its command-and-control operation, the malware opens a Unix socket, creates two directories under the /tmp directory, and stores data there that influences its operation. This data includes host events, locations of the copies of itself, process names, communication logs, tokens, and additional log information. Additionally, the malware uses environment variables to store data that further affects its execution and behavior.

    All the binaries are packed, stripped, and encrypted, indicating significant efforts to bypass defense mechanisms and hinder reverse engineering attempts. The malware also uses advanced evasion techniques, such as suspending its activity when it detects a new user in the btmp or utmp files and terminating any competing malware to maintain control over the infected system.

    By extrapolating data such as the number of Linux servers connected to the internet across various services and applications, as tracked by services such as Shodan and Censys, the researchers estimate that the number of machines infected by Perfctl is measured in the thousands. They say that the pool of vulnerable machines—meaning those that have yet to install the patch for CVE-2023-33426 or contain a vulnerable misconfiguration—is in the millions. The researchers have yet to measure the amount of cryptocurrency the malicious miners have generated.

    People who want to determine if their device has been targeted or infected by Perfctl should look for indicators of compromise included in Thursday’s post. They should also be on the lookout for unusual spikes in CPU usage or sudden system slowdowns, particularly if they occur during idle times. Thursday’s report also provides steps for preventing infections in the first place.

    This story originally appeared on Ars Technica.

    [ad_2]

    Dan Goodin, Ars Technica

    Source link

  • The FBI Still Hasn’t Cracked NYC Mayor Eric Adams’ Phone

    The FBI Still Hasn’t Cracked NYC Mayor Eric Adams’ Phone

    [ad_1]

    Pig butchering, the crypto-based scammer scourge that has pulled in an estimated $75 billion from victims globally, is spreading beyond its roots in Southeast Asia, with operations proliferating across the Middle East, Eastern Europe, Latin America, and West Africa.

    The UK’s National Crime Agency disclosed new details about the identities of the Russian ransomware group known as Evil Corp—as well as the group’s ties to Russian intelligence agencies and even its direct participation in espionage operations targeting NATO allies.

    A WIRED investigation revealed how car-mounted automatic license plate reader cameras are capturing far more than just license plates, including campaign yard signs, bumper stickers, and other politically sensitive text, all examples of how a system for tracking vehicles threatens to become a broader surveillance tool.

    In other news, ICE signed a $2 million contract with Paragon Solutions, a known vendor of spyware including the hacking tool Graphite. And the Pentagon is increasingly adopting handheld controllers for weapons systems in an effort provide more intuitive interfaces to soldiers who have grown up playing Xbox and PlayStation consoles.

    And there’s more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    As the politics of America’s biggest city have been turned upside down by the criminal charges against New York mayor Eric Adams, there’s still a “significant wild card” in the corruption case against him, prosecutors said in court this week: The FBI can’t manage to get into his phone.

    Prosecutors in the case against Adams, which centers on alleged illegal payments the mayor received from the Turkish government, revealed that the FBI still hasn’t cracked the encryption on Adams’ personal phone, nearly a year after it was seized. That phone is one of three that the bureau has taken from Adams, but agents seized Adams’ personal phone a day later than the other two devices he used in an official capacity. By that time, Adams had not only changed the passcode on the phone from a four digit PIN to six digits—a measure he says he took to prevent staffers from intentionally or unintentionally deleting information from the device. He also claims he immediately “forgot” that code to unlock it.

    That very convenient amnesia may leave the FBI and prosecutors in a situation similar to their investigation into the San Bernardino mass shooting carried out by Syed Rizwan Farook in 2016, when the US government demanded Apple help unlock the shooter’s encrypted iPhone, leading to a high-profile standoff between the Apple and the FBI. In that case, the cybersecurity firm Azimuth eventually used a closely guarded—and expensive—hacking technique to unlock the device. In Adams’ case, prosecutors hinted that the FBI may have to resort to similar measures. “Decryption always catches up with encryption,” a prosecutor in the case, Hagan Scotten, told the judge.

    Face recognition is one of only a few technologies that even Facebook and Google have hesitated to integrate into products like Google Glass and the Ray-Ban Meta smart glasses—and rightly so, given the privacy implications of a device that would allow anyone to look at a stranger on the street and immediately determine their phone number and home address. Now, however, a group of Harvard students has shown how easy it is to bolt that face recognition onto Meta’s augmented-reality eyewear. The project, known as I-XRAY, integrates with the face-recognition service Pimeyes to let Ray-Ban Meta wearers learn the name of virtually anyone they see and then immediately scour databases of personal information to determine other info about them, including names of family members, phone numbers, and home addresses. The students say they’re not releasing the code for their experiment, instead intending it as a demonstration of the privacy-invasive potential of augmented-reality devices. Point made.

    If that warning about the privacy risks of AR eyewear needed more reinforcement, Meta this week also conceded to TechCrunch that it will use input from users’ smart glasses to train its AI products. Initially, Meta declined to answer TechCrunch’s questions about whether and how it would collect information from Ray-Ban Meta smart glasses for use as AI training data, in contrast to companies like OpenAI and Anthropic that explicitly say they don’t exploit user inputs to train their AI services. A couple of days later, however, Meta confirmed to TechCrunch that it does in fact use images or video collected through its smart glasses to train its AI, but only if the user submits them to Meta’s AI tools. That means anything that a user sees and asks Meta’s AI chatbot to comment on or analyze will become part of Meta’s massive AI-training data trove.

    If you can’t arrest Russian hackers, at least you can nab their web domains. That, at least, is the approach this week of the US Justice Department, which along with Microsoft and the NGO Information Sharing and Analysis Center used a lawsuit to take control of more than a hundred web domains that had been used by Russian hackers working for the Kremlin’s intelligence and law enforcement agency known as the FSB. Those domains had been exploited in phishing campaigns by the Russian hacker group known as Star Blizzard, which has a history of targeting the typical victims of geopolitical spying such as journalists, think tanks, and NGOs. The domain seizures seem designed in part to head off threats of foreign interference in next month’s US election. “Rebuilding infrastructure takes time, absorbs resources, and costs money,” Steven Masada, the assistant general counsel of Microsoft’s Digital Crimes Unit, said in a statement. “Today’s action impacts [the hackers’] operations at a critical point in time when foreign interference in US democratic processes is of utmost concern.”

    [ad_2]

    Andy Greenberg

    Source link

  • ICE Signs $2 Million Contract With Spyware Maker Paragon Solutions

    ICE Signs $2 Million Contract With Spyware Maker Paragon Solutions

    [ad_1]

    Paragon was founded in 2019 by veterans from the Israel Defense Forces’ powerful intelligence Unit 8200 with the active involvement of former Israeli prime minister Ehud Barak as an investor who is estimated to own a sizable slice of the company.

    The company has received investment from the Boston-headquartered Battery Ventures, “considered to be one of the world’s top venture capital firms,” and two of its founders formerly worked for Blumberg Capital, another large US venture capital firm.

    Israeli media reported in June that a US private equity fund with a portfolio of security companies has been in talks to acquire control of Paragon, estimating its valuation at $1 billion.

    To secure its unique US-approved, “ethical” positioning, Paragon has made “deliberate efforts” since its establishment to break into the US market, notes the Atlantic Council.

    In 2019, as Paragon was developing Graphite, the company enlisted WestExec Advisors, a prominent Washington, DC, consulting firm cofounded by former Obama administration officials, including current US secretary of state Antony Blinken, to advise on its “strategic approach to the US and European markets,” a company executive told the Financial Times. Avril Haines, a former WestExec staffer, is now the US director of national intelligence.

    To remain in the US government’s “good graces,” Paragon in February 2023 hired another DC-based lobbying firm, Holland & Knight, “with a good track record in avoiding sanctions,” as some reports point out. Lobbying expenditure disclosure reveals a spend of a minimum $280,000 in 2023 and 2024 for this campaign.

    The fact that the spyware vendor has neither been placed on an entity list nor have any of its executives been sanctioned by the Biden administration suggests that Paragon’s lobbying efforts have been successful.

    In addition, Biden’s executive order leaves enough margin for the deployment of tools like Graphite. When a senior US administration official was asked specifically about potential abuses of Paragon’s flagship product, they said that the executive order “requires the heads of agencies to review any activity that might be relevant,” without excluding the possibility of lawful use.

    Meanwhile, the company continues to grow and is advertising several roles in Israel. In the US, Paragon boosted its presence in the wake of the signing of the executive order and started hiring intelligence veterans, including former CIA and FBI officers at its subsidiary, “hoping it would pick up new business.” Fresh reports from February 2024 confirmed the steady growth.

    Paragon’s $2 million contract with ICE is tangible proof that the company’s approach is paying off. It remains to be seen whether Graphite’s deployment will align with the protection of human rights, privacy, and democracy.

    [ad_2]

    Vas Panagiotopoulos

    Source link

  • Graid Technology Inc. and KLC Group Forge Groundbreaking Partnership to Redefine High-Speed RAID and Data-at-Rest Security

    Graid Technology Inc. and KLC Group Forge Groundbreaking Partnership to Redefine High-Speed RAID and Data-at-Rest Security

    [ad_1]

    Protecting enterprise and military servers with unmatched NVMe RAID performance and the most advanced cybersecurity encryption on the market.


    SANTA CLARA, Calif., October 1, 2024 (Newswire.com)
    –
    As data demands surge in today’s hyper-competitive landscape, organizations are constantly seeking solutions that balance cutting-edge security with uncompromised performance. A new strategic partnership between Graid Technology, creators of SupremeRAID™, and KLC Group, innovators behind CipherDriveOne Plus, is set to redefine this balance with a first-of-its-kind solution for high-speed storage and NSA CSfC-certified Data-at-Rest (DAR) Security.

    At the core of this collaboration is a novel approach to data security. Combining the National Security Agency’s (NSA) Commercial Solutions for Classified (CSfC) Data-at-Rest (DAR) Security guidelines, the joint solution integrates encryption, access controls, and authentication to deliver military-grade data protection. This breakthrough is designed to meet the critical needs of government contractors and organizations that require NSA CSfC-certified protection alongside high-performance RAID storage.

    While CipherDriveOne Plus provides robust hardware-based full-disk encryption, traditional RAID solutions have presented challenges, including drive-locking mechanisms that limit the performance of CSfC-compliant NVMe SSDs or spinning disks. SupremeRAID™ by Graid Technology offers a groundbreaking alternative. As a GPU-accelerated software RAID, SupremeRAID™ eliminates the bottlenecks and limitations of hardware RAID, allowing CSfC-compliant systems like CipherDriveOne Plus to operate without compromising authentication processes or drive performance. This results in superior data protection and seamless NVMe SSD operation.

    CipherDriveOne Plus, a Hardware Full Disk Encryption – Authorization Acquisition (AA) solution, is designed to meet the U.S. Government’s strict Data-at-Rest (DAR) standards. It provides key management, encryption, and authentication over OPAL 2.0 self-encrypting SSDs or HDDs, ensuring immediate data protection that is OS-agnostic and governed by FIPS-140-2 level key encryption with options for single, two-factor, or multi-factor authentication.

    “We are thrilled to embark on this new journey with our esteemed partner, where innovation meets collaboration. Together, we have achieved remarkable milestones and won several government customers in a short time. There is no other solution capable of our joint technology in the market today,” said Kurt Lennartsson, CEO of KLC Group.

    “By joining forces with KLC Group, we are redefining the performance and security benchmarks in high-performance computing, AI, and diverse industries reliant on data-intensive operations,” stated Leander Yu, President and CEO of Graid Technology. “The collaboration between SupremeRAID™ and CipherDriveOne Plus not only enhances performance but also ensures comprehensive data protection, scalability, and flexibility.”

    To explore the advanced data protection and storage performance offered by this partnership, download the solution brief.

    For more information:

    __________________________________________________

    About KLC Group and CipherDriveOne 
    KLC Group is a leading provider of cybersecurity solutions, dedicated to safeguarding organizations from evolving cyber threats. With a focus on innovation and excellence, KLC Group has consistently delivered cutting-edge security solutions tailored to meet the unique needs of its clients. Learn more: www.klc-group.com

    About Graid Technology and SupremeRAID™ 
    Graid Technology is led by a dedicated team of experts with decades of experience in the SDS, ASIC, and storage industries, and continues to push boundaries in data storage innovation by protecting NVMe-based data from the desktop to the cloud. Cutting-edge SupremeRAID™ GPU-based RAID removes the traditional RAID bottleneck to deliver maximum SSD performance without consuming CPU cycles or creating throughput bottlenecks, delivering unmatched flexibility, performance, and value. With headquarters in Silicon Valley supported by a robust R&D center in Taiwan, we are globally committed to spearheading advancements in storage solutions. For detailed product information, visit our website, or connect with us on Twitter (X) or LinkedIn.

    Source: Graid Technology Inc.

    [ad_2]

    Source link

  • The US Could Finally Ban Inane Forced Password Changes

    The US Could Finally Ban Inane Forced Password Changes

    [ad_1]

    Researchers found a vulnerability in a Kia web portal that allowed them to track millions of cars, unlock doors, honk horns, and even start engines in seconds, just by reading the car’s license plate. The findings are the latest in a string of web bugs that have impacted dozen of carmakers. Meanwhile, a handful of Tesla Cybertrucks have been outfitted for war and are literally being-battle tested by Chechen forces fighting in Ukraine as part of Russia’s ongoing invasion.

    As Israel escalates its attacks on Lebanon, civilians on both sides of the conflict have been receiving ominous text messages—and authorities in each country are accusing the other of psychological warfare. The US government has increasingly condemned Russia-backed media outlets like RT for working closely with Russian intelligence—and many digital platforms have removed or banned their content. But they’re still influential and trusted alternative sources of information in many parts of the world.

    And there’s more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    A new draft of the US National Institute of Standards and Technology’s “Digital Identity Guidelines” finally takes steps to eliminate reviled password management practices that have been shown to do more harm than good. The recommendations, which will be mandatory for US federal government entities and serve as guidelines for everyone else, ban the practice of requiring users to periodically change their account passwords, often every 90 days.

    The policy of regularly changing passwords evolved out of a desire to ensure that people weren’t choosing easily guessable or reused passwords; but in practice, it causes people to choose simple or formulaic passwords so they will be easier to keep track of. The new recommendations also ban “composition rules,” like requiring a certain number or mix of capital letters, numbers, and punctuation marks in each password. NIST writes in the draft that the goal of the Digital Identity Guidelines is to provide “foundational risk management processes and requirements that enable the implementation of secure, private, equitable, and accessible identity systems.”

    The US Department of Justice unsealed charges on Friday against three Iranian men who allegedly compromised Donald Trump’s presidential campaign and leaked stolen data to media outlets. Microsoft and Google warned last month that an Iranian state-sponsored hacking group known as APT42 had targeted both the Joe Biden and Donald Trump presidential campaigns, and successfully breached the Trump campaign. The DOJ claims the hackers compromised a dozen people as part of its operation, including a journalist, a human rights advocate, and several former US officials. More broadly, the US government has said in recent weeks that Iran is attempting to interfere in the 2024 election.

    “The defendants’ own words made clear that they were attempting to undermine former President Trump’s campaign in advance of the 2024 U.S. presidential election,” Attorney General Merrick Garland said at a press conference on Friday. “We know that Iran is continuing with its brazen efforts to stoke discord, erode confidence in the US electoral process, and advance its malign activities.”

    The Irish Data Protection Commission fined Meta €91 million, or roughly $101 million, on Friday for a password storage lapse in 2019 that violated the European Union’s General Data Protection Regulation. Following a report by Krebs on Security, the company acknowledged in March 2019 that a bug in its password management systems had caused hundreds of millions of Facebook, Facebook Lite, and Instagram passwords to be stored without protection in plaintext in an internal platform. Ireland’s privacy watchdog launched its investigation into the incident in April 2019.

    “It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data,” Irish DPC deputy commissioner Graham Doyle said in a statement. “It must be borne in mind that the passwords, the subject of consideration in this case, are particularly sensitive, as they would enable access to users’ social media accounts.”

    The digital anonymity nonprofit the Tor Project is merging with privacy- and anonymity-focused Linux-based operating system Tails. Pavel Zoneff, the Tor Project’s communications director, wrote in a blog post on Thursday that the move will facilitate collaboration and reduce costs, while expanding both groups’ reach. “Tor and Tails provide essential tools to help people around the world stay safe online,” he wrote. “By joining forces, these two privacy advocates will pool their resources to focus on what matters most: ensuring that activists, journalists, other at-risk and everyday users will have access to improved digital security tools.”

    [ad_2]

    Lily Hay Newman

    Source link

  • Give Your Business’s PCs an Internal Makeover With Windows 10 Pro, Now $20 | Entrepreneur

    Give Your Business’s PCs an Internal Makeover With Windows 10 Pro, Now $20 | Entrepreneur

    [ad_1]

    Disclosure: Our goal is to feature products and services that we think you’ll find interesting and useful. If you purchase them, Entrepreneur may get a small share of the revenue from the sale from our commerce partners.

    The average company spends 3.28% of its revenue on technology, and that doesn’t include software or hardware renewals, according to a study conducted by Deloitte. Although your company’s tech equipment budget may be costly, you don’t have to spend hundreds on new devices each year to boost productivity.

    Instead, you could make those you already have more efficient. First up is your PC. If it isn’t already running on Windows 10 Pro, you’re missing out on the latest productivity tools and innovative security measures. Through September 29, this operating system is on sale for $19.97 (reg. $199) for life.

    Increased productivity for your PC

    If you’ve noticed slower performance on your device, this operating system (OS) upgrade is designed to enhance your PC’s performance and efficiency. Thanks to its 64-bit computing architecture, business owners and their employees can multitask while crunching numbers on Excel, designing company graphics, and leading stakeholder meetings.

    Windows 10 Pro is also designed to integrate seamlessly with Microsoft 365 (not included with your purchase). Companies using Microsoft 365 for access to Microsoft productivity apps will be able to edit Word documents, collaborate with colleagues on Teams, and more at any time.

    Designed specifically for working professionals

    As a solopreneur or working professional, you’ll benefit from the Pro side of Windows 10 (vs. Home, the free version).

    Secure your PC’s hard drive with BitLocker device encryption, test software with Windows Sandbox, manage virtual machines with Hyper-V, and deploy specific policies for different devices, users, and groups with Group Policy management. This OS is designed to keep your data and devices protected from tampering and malware.

    Entrepreneurs and their employees can also control their PC from any remote device with the Remote Desktop feature, allowing for access to their work files and colleagues wherever they are.

    Boost your productivity and streamline your workflow with Windows 10 Pro, now on sale for $19.97 (reg. $199) through September 29 at 11:59 p.m. PT. No coupon is needed.

    StackSocial prices subject to change.

    [ad_2]

    StackCommerce

    Source link

  • Iranian Hackers Tried to Give Hacked Trump Campaign Emails to Dems

    Iranian Hackers Tried to Give Hacked Trump Campaign Emails to Dems

    [ad_1]

    The week was dominated by news that thousands of pagers, walkie-talkies and other devices were exploding across Lebanon on Tuesday and Wednesday in an attack targeting the militant group Hezbollah. At least 32 people were killed, including at least four children, and more than 3,200 people were injured. The covert campaign has widely been attributed to Israel, though none of the country’s government agencies have commented.

    In addition to the carnage, the attacks have—seemingly by design—had the effect of sowing paranoia and fear, not just among members of Hezbollah but also in the general Lebanese public. Hardware and warfare experts say that the incident is unlikely to establish a global precedent that people’s most trusted communication devices and electronics, like smartphones, are rigged with explosives left and right. But it does create the potential to inspire copycats and puts defenders on notice that such attacks are possible.

    Researchers say that China’s 2023 Zhujian Cup, a hacking competition with ties to the country’s military, took the unusual step of requiring participants to keep the content of the exercise secret—and they may have been targeting a real victim as part of the event. Apple’s new stand-alone app Passwords that launched with iOS 18 may help solve your login problems. And a now-deleted post from billionaire Elon Musk that questioned why no one has attempted to assassinate Joe Biden and Kamala Harris renewed concerns this week that Musk is willing to inspire extremist violence and is a national security threat in the United States.

    And there’s more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    Last month, media outlets, Microsoft, and Google warned that an Iranian state-sponsored hacking group known as APT42 had targeted both the Joe Biden and Donald Trump political campaigns, and that it had successfully stolen emails from the Trump campaign that were later shared with reporters. Now the FBI has chimed in with the added revelation that the same hackers also sent those stolen Trump communications to the Democrats, too—though for now there’s no sign that the Democrats solicited those emails from the Iranians or necessarily even received the Iranians’ message.

    Republicans were nonetheless quick to compare the news to accusations that the Trump campaign “colluded” with the Russian hackers, part of the Kremlin’s GRU military intelligence agency, who breached the Democratic National Committee and the Clinton Campaign in 2016 to carry out a hack-and-leak operation. In a statement, the Trump campaign demanded that the Democrats “must come clean on whether they used the hacked material.” The Harris campaign told CNN that it has cooperated with law enforcement and that it was “not aware of any material being sent directly to the campaign,” believing the emails to be spam or phishing attempts. “We condemn in the strongest terms any effort by foreign actors to interfere in US elections, including this unwelcome and unacceptable malicious activity,” Morgan Finkelstein, the national security spokesperson for the Harris campaign, told CNN.

    The FBI announced this week that it had taken down a network of hacked machines being secretly controlled by a Chinese state-sponsored hacking group known as Flax Typhoon. The botnet, made up of 260,000 routers and internet-of-things devices, was allegedly being run by a Chinese contractor known as the Beijing Integrity Technology Group, a rare instance of a known, publicly traded company operating essentially a massive collection of hacked devices on behalf of the Chinese state. The botnet, according to the FBI and security firm Black Lotus Labs, had been used to hack government agencies, defense contractors, telecoms, and other US and Taiwanese targets. At the time of its takedown, the botnet still encompassed 60,000 machines, making it the largest Chinese state-sponsored botnet ever, according to Black Lotus Labs.

    On Wednesday night, two young men were arrested after they allegedly stole hundreds of millions of dollars of cryptocurrency and spent the earnings on luxury cars, watches, jewelry, and designer handbags. In an unsealed indictment, the US Department of Justice charged Malone Lam, 20, known online as “Anne Hathaway” and Jeandiel Serrano, 21, aka “VersaceGod,” with stealing $243 million in cryptocurrency and laundering the proceeds through mixing services to conceal the origin.

    CoinDesk reported that the men allegedly tricked the heist’s victim, a creditor of the now-defunct trading firm Genesis, using a social engineering scam that led them to reset their Gemini two-factor authentication and transfer 4,100 bitcoin to a compromised wallet. An analysis of the transaction by blockchain investigator ZachXBT revealed that the $243 million was divided among multiple wallets and then distributed to over 15 exchanges.

    On Thursday, TechCrunch reported that Apple’s latest desktop operating system update, macOS 15 (Sequoia), breaks some functionality of major security tools made by CrowdStrike, SentinelOne, and Microsoft. It’s unclear what specifically in the update is causing the issues, but social media posts and internal Slack messages reviewed by the tech outlet show that the update has frustrated engineers working on macOS-focused security tools.

    A CrowdStrike sales engineer informed colleagues via Slack, as seen by TechCrunch, that the company would not be able to support Sequoia on day one, despite its usual practice of quickly supporting new OS releases. While they hope for a quick patch, they will likely need to scramble to resolve the issue with an update in their own code, assuming no immediate fix is available from Apple, which has not yet commented on the issue.

    Cryptocurrency theft has become practically a common-garden form of cybercrime. But one brutal gang took that form of thievery to a new level of cruelty and violence, breaking into a series of victims’ homes to threaten and extort them into handing over their crypto holdings, sometimes even resorting to kidnapping and torture. This week, that disturbing story came to a close with the sentencing of the group’s ring leader, a Florida man named Remy St. Felix, to 47 years in prison. St. Felix is one of 12 members of the gang to have now been charged, convicted, and sentenced. Prior to the home invasions that St. Felix led, another member of the group named Jarod Seemungal allegedly stole millions with more traditional crypto hacking techniques. But St. Felix’s more violent, offline extortion attempts netted his gang only around $150,000 in cryptocurrency before they were caught and sentenced to years behind bars. The lesson: Crime doesn’t pay—or at least, not the physical kind.

    [ad_2]

    Andy Greenberg, Lily Hay Newman, Dhruv Mehrotra

    Source link

  • Did a Chinese University Hacking Competition Target a Real Victim?

    Did a Chinese University Hacking Competition Target a Real Victim?

    [ad_1]

    Capture the flag hacking contests at security conferences generally serve two purposes: to help participants develop and demonstrate computer hacking and security skills, and to assist employers and government agencies with discovering and recruiting new talent.

    But one security conference in China may have taken its contest a step further—potentially using it as a secret espionage operation to get participants to collect intelligence from an unknown target.

    According to two Western researchers who translated documentation for China’s Zhujian Cup, also known as the National Collegiate Cybersecurity Attack and Defense Competition, one part of the three-part competition, held last year for the first time, had a number of unusual characteristics that suggest its potentially secretive and unorthodox purpose.

    Capture the flag (CTF) and other types of hacking competitions are generally hosted on closed networks or “cyber ranges”—dedicated infrastructure set up for the contest so that participants don’t risk disrupting real networks. These ranges provide a simulated environment that mimics real-world configurations, and participants are tasked with finding vulnerabilities in the systems, obtaining access to specific parts of the network, or capturing data.

    There are two major companies in China that set up cyber ranges for competitions. The majority of the competitions give a shout out to the company that designed their range. Notably, Zhujian Cup didn’t mention any cyber range or cyber range provider in its documentation, leaving the researchers to wonder if this is because the contest was held in a real environment rather than a simulated one.

    The competition also required students to sign a document agreeing to several unusual terms. They were prohibited from discussing the nature of the tasks they were asked to do in the competition with anyone; they had to agree not to destroy or disrupt the targeted system; and at the end of the competition, they had to delete any backdoors they planted on the system and any data they acquired from it. And unlike other competitions in China the researchers examined, participants in this portion of the Zhujian Cup were prohibited from publishing social media posts revealing the nature of the competition or the tasks they performed as part of it.

    Participants also were prohibited from copying any data, documents, or printed materials that were part of the competition; disclosing information about vulnerabilities they found; or exploiting those vulnerabilities for personal purposes. If a leak of any of this data or material occurred and caused harm to the contest organizers or to China, according to the pledge that participants signed, they could be held legally responsible.

    “I promise that if any information disclosure incident (or case) occurs due to personal reasons, causing loss or harm to the organizer and the country, I, as an individual, will bear legal responsibility in accordance with the relevant laws and regulations,” the pledge states.

    The contest was hosted last December by Northwestern Polytechnical University, a science and engineering university in Xi’an, Shaanxi, that is affiliated with China’s Ministry of Industry and Information Technology and also holds a top-secret clearance to conduct work for the Chinese government and military. The university is overseen by China’s People’s Liberation Army.

    [ad_2]

    Kim Zetter

    Source link

  • The Mystery of Hezbollah’s Deadly Exploding Pagers

    The Mystery of Hezbollah’s Deadly Exploding Pagers

    [ad_1]

    The AP-900 runs on two AAA batteries, which, like any battery, could be induced to explode, but likely not with such force and scale as the explosions depicted in alleged videos of the blasts. If the pagers used by Hezbollah are the AR-924 or another model that runs on lithium-ion batteries, which can cause more dangerous explosions, it’s still unlikely that a regular pager battery alone could produce blasts that could injure multiple people.

    “Those explosions aren’t just batteries,” says Jake Williams, vice president of research and development at Hunter Strategy who formerly worked for the US National Security Agency. “Based on the reporting, these pagers were likely interdicted by Israeli authorities and modified with explosives. This highlights the risks of supply chain security, especially in places where technology is harder to ship to.”

    Gold Apollo did not immediately respond to WIRED’s request for comment.

    Williams points out that such an operation would likely involve operatives on both the tech distribution side and the Hezbollah procurement side. “You compromise the supply chain, but you don’t want thousands of explosive pagers running around Lebanon,” he says. “The mole gets them to exactly the right people.”

    Some reports on Tuesday indicate that Hezbollah recently expanded its use of pagers in an attempt to secure communications after other channels had been infiltrated by Israeli intelligence. The Associated Press reported that an anonymous “Hezbollah official” said the group had recently adopted a “new brand” of pagers that “first heated up, then exploded.”

    “It’s unlikely that hacking was involved, as it’s likely that explosive material had to be inside the pagers to cause such an effect,” says Lukasz Olejnik, an independent consultant and visiting senior research fellow at King’s College London’s Department of War Studies. “Reports mention the delivery of new pagers recently, so perhaps the delivery was compromised.”

    Michael Horowitz, head of intelligence at Middle East and North Africa risk management company Le Beck International, says if the attack is supply-chain-based, then it could have taken years to prepare and involved infiltrating a supplier and placing explosives inside new pagers.

    “This is a major security breach, particularly if we’re talking about a charge that was placed inside the devices—which, in my opinion, is the most likely scenario,” Horowitz says. “This would mean that Israel has managed to infiltrate Hezbollah providers to the point of delivering hundreds (if not thousands) of devices used for secured communication.”

    The incident comes amid escalations of fighting between Israel and Hezbollah in recent months, raising fears of a full-blown war. In the hours before the explosions on Tuesday, Israel said its war goals would include allowing 60,000 people to return to Northern Israel after they were evacuated following Hezbollah attacks, and it would not rule out military action.

    Horowitz says the incident could be a “prelude to a broader offensive” and possibly meant to disrupt Hezbollah’s communications networks. It is likely that replacing a large number of pagers would take some time to organize. Alternatively, Horowitz says, the attack could also have been conducted to show the “scale of Israel’s intelligence penetration.”

    “This is a high-value operation that you wouldn’t use just to cause injuries,” Horowitz says.

    Even if the blasts were not caused by a cyber-physical attack that induced the pager batteries to explode, it’s still possible that explosives planted in the pagers were detonated using a remote command, possibly even a specially crafted pager message. Some footage appeared to show users checking their pagers right as the explosions occurred, though this could have been coincidental.

    The operation could have a psychological impact on Hezbollah given that bombs may have been lurking undetected in such an unassuming device. And though Tuesday’s attacks were notably aggressive, it would not be the first time Israeli intelligence has reportedly planted explosives in electronics.

    Updated at 3:25 pm ET, September 17, 2024: Added additional details about potential ways the attack could have been carried out.

    Updated at 3:40 pm ET, September 17, 2024: Added additional details about the pager model that may have been used in the attack.

    [ad_2]

    Lily Hay Newman, Matt Burgess

    Source link

  • A Creative Trick Makes ChatGPT Spit Out Bomb-Making Instructions

    A Creative Trick Makes ChatGPT Spit Out Bomb-Making Instructions

    [ad_1]

    After Apple’s product launch event this week, WIRED did a deep dive on the company’s new secure server environment, known as Private Cloud Compute, which attempts to replicate in the cloud the security and privacy of processing data locally on users’ individual devices. The goal is to minimize possible exposure of data processed for Apple Intelligence, the company’s new AI platform. In addition to hearing about PCC from Apple’s senior vice president of software engineering, Craig Federighi, WIRED readers also received a first look at content generated by Apple Intelligence’s “Image Playground” feature as part of crucial updates on the recent birthday of Federighi’s dog Bailey.

    Turning to privacy protection of a very different kind in another new AI service, WIRED looked at how users of the social media platform X can keep their data from being slurped up by the “unhinged” generative AI tool from xAI known as Grok AI. And in other news about Apple products, researchers developed a technique for using eye tracking to discern passwords and PINs people typed using 3D Apple Vision Pro avatars—a sort of keylogger for mixed reality. (The flaw that made the technique possible has since been patched.)

    On the national security front, the US this week indicted two people accused to spreading propaganda meant to inspire “lone wolf” terrorist attacks. The case, against alleged members of the far-right network known as the Terrorgram Collective, marks a turn in how the US cracks down on neofascist extremists.

    And there’s more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    OpenAI’s generative AI platform ChatGPT is designed with strict guardrails that keep the service from offering advice on dangerous and illegal topics like tips on laundering money or a how-to guide for disposing of a body. But an artist and hacker who goes by “Amadon” figured out a way to trick or “jailbreak” the chatbot by telling it to “play a game” and then guiding it into a science-fiction fantasy story in which the system’s restrictions didn’t apply. Amadon then got ChatGPT to spit out instructions for making dangerous fertilizer bombs. An OpenAI spokesperson did not respond to TechCrunch’s inquiries about the research.

    “It’s about weaving narratives and crafting contexts that play within the system’s rules, pushing boundaries without crossing them. The goal isn’t to hack in a conventional sense but to engage in a strategic dance with the AI, figuring out how to get the right response by understanding how it ‘thinks,’” Amadon told TechCrunch. “The sci-fi scenario takes the AI out of a context where it’s looking for censored content … There really is no limit to what you can ask it once you get around the guardrails.”

    In the fervent investigations following the September 11, 2001, terrorist attacks in the United States, the FBI and CIA both concluded that it was coincidental that a Saudi Arabian official had helped two of the hijackers in California and that there had not been high-level Saudi involvement in the attacks. The 9/11 commission incorporated that determination, but some findings indicated subsequently that the conclusions might not be sound. With the 23-year anniversary of the attacks this week, ProPublica published new evidence “suggest[ing] more strongly than ever that at least two Saudi officials deliberately assisted the first Qaida hijackers when they arrived in the United States in January 2000.”

    The evidence comes primarily from a federal lawsuit against the Saudi government brought by survivors of the 9/11 attacks and relatives of victims. A judge in New York will soon make a decision in that case about a Saudi motion to dismiss. But evidence that has already emerged in the case, including videos and documents such as telephone records, points to possible connections between the Saudi government and the hijackers.

    “Why is this information coming out now?” said retired FBI agent Daniel Gonzalez, who pursued the Saudi connections for almost 15 years. “We should have had all of this three or four weeks after 9/11.”

    The United Kingdom’s National Crime Agency said on Thursday that it arrested a teenager on September 5 as part of the investigation into a cyberattack on September 1 on the London transportation agency Transport for London (TfL). The suspect is a 17-year-old male and was not named. He was “detained on suspicion of Computer Misuse Act offenses” and has since been released on bail. In a statement on Thursday, TfL wrote, “Our investigations have identified that certain customer data has been accessed. This includes some customer names and contact details, including email addresses and home addresses where provided.” Some data related to the London transit payment cards known as Oyster cards may have been accessed for about 5,000 customers, including bank account numbers. TfL is reportedly requiring roughly 30,000 users to appear in person to reset their account credentials.

    In a decision on Tuesday, Poland’s Constitutional Tribunal blocked an effort by Poland’s lower house of parliament, known as the Sejm, to launch an investigation into the country’s apparent use of the notorious hacking tool known as Pegasus while the Law and Justice (PiS) party was in power from 2015 to 2023. Three judges who had been appointed by PiS were responsible for blocking the inquiry. The decision cannot be appealed. The decision is controversial, with some, like Polish parliament member Magdalena Sroka, saying that it was “dictated by the fear of liability.”

    [ad_2]

    Lily Hay Newman

    Source link