ReportWire

Tag: encryption

  • The WIRED Guide to Digital Opsec for Teens

    [ad_1]

    Expand your mind, man. Opsec is really all about time travel—taking small, protective steps now before you have a disaster on your hands later. If you’re not on auto-delete, then an explosive, emotional text exchange with the person you’re currently dating—or, ahem, photos you sent to each other—will hang around forever. It’s normal for things to change and for relationships of all types to come and go. You may trust someone and be close to them now but grow apart in a year or two.

    If you imagine an even more extreme scenario where you’re being investigated by the police, they could obtain warrants to search your digital accounts or devices. People have to go to great lengths to maintain their opsec if they’re trying to hide activity from law enforcement. To be clear, this guide is definitely not encouraging you to do crimes. Don’t do crimes! The goal is just to understand the value of keeping basic opsec principles in mind, because if some of your digital information is revealed haphazardly or out of context, it could, theoretically, appear incriminating.

    You probably intuitively understand a lot of this. Don’t give your password to friends, duh.) So this guide is going to largely skip the obvious and emphasize more subtle, unintended consequences of failing to practice good opsec.

    Memorable Opsec Fails

    “Signalgate,” 2025: US officials discussed war plans in a group chat on the mainstream, secure messaging app Signal. Then they accidentally added a journalist to the chat. Subsequently, US defense secretary Pete Hegseth famously (embarrassingly) messaged the chat, “we are currently clean on OPSEC.” At least some members of the chat were also potentially using a modified, insecure version of Signal. All extremely not clean on opsec.

    Gmail Drafts Exposed, 2012: Then-CIA director David Petraeus and his paramour shared a Gmail account to hide their communications by leaving them for each other to see as draft messages. Kind of ingenious given that this was before most texting or messaging apps offered timed disappearing/ephemeral messages, but the FBI figured out the strategy.

    Identities

    Opsec is all about compartmentalizing, and that’s the hardest part. Failure to compartmentalize is often how criminals get caught or how information that was meant to stay secret gets exposed. Think of your online life like rooms in a house. Each room has a separate key. If someone breaks into one room, they can grab everything there, but you don’t want them to be able to run wild beyond that room.

    You can have multiple identities online and compartmentalize the activities of each, but it takes forethought to maintain the separation. There’s the real you who uses your main Gmail or Apple ID for personal and family stuff and social accounts where you use your real name, plus school and maybe work. Another compartment is your school email and school file storage. Then there’s your more adaptable, online personas who may have semi-anonymous handles, like jnd03 for Jane Doe. Friends know that these accounts are yours and classmates can probably guess them. Finally, there may be a pseudonymous you: alt accounts with no obvious link to real you—like Jane Doe using the handles “_aksdi0_0” or “peter_mayfield01.”

    Rules of Separation

    You have accounts under your real name, but you probably also need pseudonymous accounts. Tight compartmentalization will prevent people from doxing your pseudonymous accounts. But that’s easier said than done.

    Obviously, don’t recycle usernames across platforms. If JaneD03 is your Instagram handle, don’t use it or a similar name for your anonymous Reddit account. Don’t even reuse passwords—but especially don’t reuse passwords between real and pseudonymous accounts. To prevent a compromised pseudonymous account from revealing your name, don’t use your main email address; instead, use a unique, pseudonymous one. Gmail “dot tricks” (jane.doe@, j.ane.doe@) don’t count, because they all equally reveal your master account.

    [ad_2]

    JP Aumasson, Lily Hay Newman

    Source link

  • US Border Patrol Is Spying on Millions of American Drivers

    [ad_1]

    Eight years after a researcher warned WhatsApp that it was possible to extract user phone numbers en masse from the Meta-owned app, another team of researchers found that they could still do exactly that using a similar technique. The issue stems from WhatsApp’s discovery feature, which allows someone to enter a person’s phone number to see if they’re on the app. By doing this billions of times—which WhatsApp did not prevent—researchers from the University of Vienna uncovered what they’re calling “the most extensive exposure of phone numbers” ever.

    Vaping is a major problem in US high schools. But is the solution to spy on students in the bathroom? An investigation by The 74, copublished with WIRED, found that schools around the country are turning to vape detectors in an effort to crack down on nicotine and cannabis consumption on school grounds. Some of the vape detectors go far beyond detecting vapor by including microphones that are surprisingly accurate and revealing. While few defend addiction and drug use, even non-vapers say the added surveillance and the punishments that result go too far.

    Don’t look now, but that old networking equipment your company hasn’t thought about in years may jump out and bite you. Tech giant Cisco this week launched a new initiative, warning companies that AI tools are making it increasingly simple for attackers to find vulnerabilities in outdated and unpatched networking infrastructure. The message: Upgrade or else.

    If you’ve ever attended a conference, you probably worried about getting sick in the cesspools that are a conference center. But one hacker conference in New Zealand, Kawaiicon, invented a novel way to keep attendees a little bit safer. By tracking the CO2 levels in each conference room, Kawaiicon’s organizers were able to create a real-time air-quality monitoring system, which would tell people which rooms were safe and which seemed … gross. The project brings new meaning to antivirus monitoring.

    And that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    The US Border Patrol is operating a predictive-intelligence program that monitors millions of American drivers far beyond the border, according to a detailed investigation by the Associated Press. A network of covert license-plate readers—often hidden inside traffic cones, barrels, and roadside equipment—feeds data into an algorithm that flags “suspicious” routes, quick turnarounds, and travel to and from border regions. Local police are then alerted, resulting in traffic stops for minor infractions like window-tint violations, air fresheners, or marginal speeding. AP reviewed police records showing that drivers were questioned, searched, and sometimes arrested despite no contraband being found.

    Internal group chats obtained through public-records requests show Border Patrol agents and Texas deputies sharing hotel records, rental car status, home addresses, and social media details of US citizens in real time while coordinating what officers call “whisper stops” to obscure federal involvement. The AP identified plate-reader sites more than 120 miles from the Mexican border in the Phoenix area, as well as locations in metropolitan Detroit and near the Michigan-Indiana line that capture traffic headed toward Chicago and Gary. Border Patrol also taps DEA plate-reader networks and has, at various times, accessed systems run by Rekor, Vigilant Solutions, and Flock Safety.

    CBP says the program is governed by “stringent” policies and constitutional safeguards, but legal experts told AP that its scale raises new Fourth Amendment concerns. A UC Law San Francisco official said the system amounts to a “dragnet” tracking Americans’ movements, associations, and daily routines.

    Microsoft claims to have mitigated the largest distributed denial-of-service (DDoS) attack ever recorded in a cloud environment—a 15.72 Tbps, 3.64-billion-pps barrage launched on October 24 against a single Azure endpoint in Australia. Microsoft says The attack “originated from the Aisuru botnet,” a Turbo-Mirai–class IoT network of compromised home routers, cameras, and other consumer devices. More than 500,000 IP addresses are said to have participated, generating a massive DDoS attack with little spoofing. Microsoft says its global Azure DDoS Protection network absorbed the traffic without service disruption. Microsoft described the attack as the “the largest DDoS ever observed in the cloud,” emphasizing the single endpoint; however, Cloudflare also recently reported a 22.2 Tbps flood, naming it the largest DDoS attack ever seen.

    Researchers note that Aisuru has recently launched multiple attacks exceeding 20 Tbps and is expanding its capabilities to include credential stuffing, AI-driven scraping, and HTTPS floods via residential proxies.

    The US Securities and Exchange Commission has dropped its remaining claims against SolarWinds and its CISO, Tim Brown, ending a long-running case over the company’s 2020 supply-chain hack, in which Russian SVR operatives allegedly compromised SolarWinds’ Orion software and triggered widespread breaches across government and industry. The agency’s lawsuit—filed in 2023 and centered on alleged fraud and internal-control failures—had already been mostly dismantled by a federal judge in 2024. SolarWinds called the full dismissal a vindication of its argument that its disclosures and conduct were appropriate and said it hopes the outcome eases concerns among CISOs about the case’s potential chilling effect.

    Law enforcement records show that the FBI accessed messages from a private Signal group used by New York immigration court-watch activists—a network that coordinates volunteers monitoring public hearings at three federal immigration courts. According to a two-page FBI/NYPD “joint situational information report” dated August 28, 2025, agents quoted chat messages, labeled the nonviolent court watchers as “anarchist violent extremist actors,” and circulated the assessment nationwide. The report did not explain how the FBI penetrated an encrypted Signal group, but it claimed the information came from a “sensitive source with excellent access.”

    The documents, first reported by the Guardian, were original obtained by the government-transparency group Property of the People. They describe activists discussing how to enter courtrooms, film officers, and gather identifying details of federal personnel, but provide no evidence to support the FBI’s allegation that a member previously advocated violence. A separate set of records—also obtained by the group—shows the bureau framed ordinary observation of public immigration hearings as a potential threat, even as Immigration and Customs Enforcement has escalated courthouse arrests and set what advocates call “deportation traps.” Civil liberties experts told the paper that the surveillance mirrors earlier FBI campaigns targeting lawful dissent and risks chilling protected political activity.

    [ad_2]

    Dell Cameron, Andrew Couts

    Source link

  • Browser Password Managers Are Great, and a Terrible Idea

    [ad_1]

    By default, Google manages your encryption key, but it allows you to set up on-device encryption, which functions similarly to a zero-knowledge architecture. Your passwords are encrypted before being saved on your device, and you manage the key. Regardless of how the encryption works, Google uses AES, which is still the gold standard for security among password managers.

    It was trivial to decrypt Chrome passwords previously, requiring little more than a Python script and knowledge of where the files are stored. But even there, Google has pushed the security bar up. App-bound encryption has invalidated those methods, and cracking passwords is far more involved than it used to be. Further, Google has integrated with Windows Hello. If you choose, you can have Windows Hello protect your passwords each time you log in by asking for your PIN or biometric authentication.

    Other browsers aren’t as secure. Firefox, for instance, makes it clear that, although passwords saved in Firefox are encrypted, “someone with access to your computer user profile can still see or use them.” Brave works in a similar way, though I suspect most people using Brave are using a third-party password manager (and probably a VPN) already.

    Regardless, storing your passwords in even a less secure browser like Firefox is leaps and bounds better than not using a password manager at all. And the browsers at the forefront of market share, Chrome and Safari, have vastly improved their security practices over the past few years. The problem isn’t encryption—it’s putting all your eggs in one basket.

    Let’s Talk OpSec

    OpSec, or operational security, is normally a term used when talking about sensitive data in government or private organizations, but you can look at your own security through an OpSec lens. If you were an attacker and wanted to swipe someone’s passwords, how would you go about it? I know where I’d look first.

    Even with better security measures, the goal of a browser-based password manager is to get people using password managers. That has to be balanced against how easy the password manager is to use. In a blog post announcing changes to Google’s authentication methods from Google I/O this year, the company mentions reducing “friction” seven times, while “encryption” isn’t mentioned at all. That’s not a bad thing, but it’s a testament to how these tools are designed.

    You don’t need to pick out words from a blog post to see this focus. Google gives you the option to turn on Windows Hello or biometric authentication with the Google Password Manager. Each time you want to fill in a password, you’ll need to authenticate. That’s undoubtedly more secure than not authenticating each time, but the setting is turned off by default. It creates friction.

    [ad_2]

    Jacob Roach

    Source link

  • Hackers Dox ICE, DHS, DOJ, and FBI Officials

    [ad_1]

    In a stunning new study, researchers at UC San Diego and the University of Maryland revealed this week that satellites are leaking a wealth of sensitive data completely unencrypted, from calls and text messages on T-Mobile to in-flight Wi-Fi browsing sessions, to military and police communications. And they did this with just $800 in off-the-shelf equipment.

    Face recognition systems are seemingly everywhere. But what happens when this surveillance and identification technology doesn’t recognize your face as a face? WIRED spoke with six people with facial differences who say flaws in these systems are preventing them from accessing essential services.

    Authorities in the United States and United Kingdom announced this week the seizure of nearly 130,000 bitcoins from an alleged Cambodian scam empire. At the time of the seizure, the cryptocurrency fortune was worth $15 billion—the most money of any type ever confiscated in the US.

    Control over a significant portion of US election infrastructure is now in the hands of a single former Republican operative, Scott Leiendecker, who just purchased voting machine company Dominion Voting Systems and owns Knowink, an electronic poll book firm. Election security experts are currently more baffled about the implications than worried about any possibility of foul play.

    While a new type of attack could let hackers steal two-factor authentication codes from Android phones, the biggest cybersecurity development of the week was the breach of security firm F5. The attack, which was carried out by a “sophisticated” threat actor reportedly linked to China, poses an “imminent threat” of breaches against government agencies and Fortune 500 companies. Finally, we sifted through the mess that is VPNs for iPhones and found the only three worth using.

    But that’s not all! Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    In recent years, perhaps no single group of hackers has caused more mayhem than “the Com,” a loose collective of mostly cybercriminal gangs whose subgroups like Lapus$ and Scattered Spider have carried out cyberattacks and ransomware extortion operations targeting victims from MGM Casinos to Marks & Spencer grocery stores. Now they’ve turned their sites to US federal law enforcement.

    On Thursday, one member of the Com’s loose collective began posting to Telegram an array of federal officials’ identifying documents. One spreadsheet, according to 404 Media, contained what appeared to be personal information of 680 Department of Homeland Security officials, while another included personal info on 170 FBI officials, and yet another doxed 190 Department of Justice officials. The data in some cases included names, email addresses and phone numbers, and addresses—in some cases of officials’ homes rather than the location of their work. The user who released the data noted in their messages a statement from the DHS that Mexican cartels have offered thousands of dollars for identifying information on agents, apparently mocking this unverified claim.

    “Mexican Cartels hmu we dropping all the doxes wheres my 1m,” the user who released the files wrote, using the abbreviation for “hit me up” and seemingly demanding a million dollars. “I want my MONEY MEXICO.”

    Over the last year—at least—the FBI has operated a “secret” task force that may have worked to disrupt Russian ransomware gangs, according to reports published this week in France’s Le Monde and Germany’s Die Zeit. The publications allege that at the end of last year, the mysterious Group 78 presented its strategy to two different meetings of European officials, including law enforcement officials and those working in judicial services. Little is known about the group; however, its potentially controversial tactics appeared to spur typically tight-lipped European officials to speak out about Group 78’s existence and tactics.

    At the end of last year, according to the reports, Group 78 was focusing on the Russian-speaking Black Basta ransomware gang and outlined two approaches: running operations inside Russia to disrupt the gang’s members and try to get them to leave the country; and also to “manipulate” Russian authorities into prosecuting Black Basta members. Over the last few years, Western law enforcement officials have taken increasingly disruptive measures against Russian ransomware gangs—including infiltrating their technical infrastructure, trying to ruin their reputations, and issuing a wave of sanctions and arrest warrants—but taking covert action inside Russia against ransomware gangs would be unprecedented (at least in public knowledge). The Black Basta group has in recent months gone dormant after 200,000 of its internal messages were leaked and its alleged leader identified.

    Over the last few years, AI-powered license plate recognition cameras—which are placed at the side of the road or in cop cars—have gathered billions of images of people’s vehicles and their specific locations. The technology is a powerful surveillance tool that, unsurprisingly, has been adopted by law enforcement officials across the United States—raising questions about how access to the cameras and data can be abused by officials.

    This week, a letter by Senator Ron Wyden revealed that one division of ICE, the Secret Service, and criminal investigators at the Navy all had access to data from the cameras of Flock Safety. “I now believe that abuses of your product are not only likely but inevitable, and that Flock is unable and uninterested in preventing them,” Wyden’s letter addressed to Flock says. Wyden’s letter follows increasing reports that government agencies, including the CBP, had access to Flock’s 80,000 cameras. “In my view,” Wyden wrote, “local elected officials can best protect their constituents from the inevitable abuses of Flock cameras by removing Flock from their communities.”

    [ad_2]

    Andy Greenberg, Matt Burgess

    Source link

  • Apple Announces $2 Million Bug Bounty Reward for the Most Dangerous Exploits

    [ad_1]

    Since launching its bug bounty program nearly a decade ago, Apple has always touted notable maximum payouts—$200,000 in 2016 and $1 million in 2019. Now the company is upping the stakes again. At the Hexacon offensive security conference in Paris on Friday, Apple vice president of security engineering and architecture Ivan Krstić announced a new maximum payout of $2 million for a chain of software exploits that could be abused for spyware.

    The move reflects how valuable exploitable vulnerabilities can be within Apple’s highly protected mobile environment—and the lengths the company will go to to keep such discoveries from falling into the wrong hands. In addition to individual payouts, the company’s bug bounty also includes a bonus structure, adding additional awards for exploits that can bypass its extra secure Lockdown Mode as well as those discovered while Apple software is still in its beta testing phase. Taken together, the maximum award for what would otherwise be a potentially catastrophic exploit chain will now be $5 million. The changes take effect next month.

    “We are lining up to pay many millions of dollars here, and there’s a reason,” Krstić tells WIRED. “We want to make sure that for the hardest categories, the hardest problems, the things that most closely mirror the kinds of attacks that we see with mercenary spyware—that the researchers who have those skills and abilities and put in that effort and time can get a tremendous reward.”

    Apple says that there are more than 2.35 billion of its devices active around the world. The company’s bug bounty was originally an invite-only program for prominent researchers, but since opening to the public in 2020, Apple says that it has awarded more than $35 million to more than 800 security researchers. Top-dollar payouts are very rare, but Krstić says that the company has made multiple $500,000 payouts in recent years.

    In addition to higher potential rewards, Apple is also expanding the bug bounty’s categories to include certain types of one-click “WebKit” browser infrastructure exploits as well as wireless proximity exploits carried out with any type of radio. And there is even a new offering known as “Target Flags” that puts the concept of capture the flag hacking competitions into real-world testing of Apple’s software to help researchers demonstrate the capabilities of their exploits quickly and definitively.

    Apple’s bug bounty is just one of many long-term investments aimed at reducing the prevalence of dangerous vulnerabilities or blocking their exploitation. For example, after more than five years of work, the company announced a security protection last month in the new iPhone 17 lineup that aims to nullify the most frequently exploited class of iOS bugs. Known as Memory Integrity Enforcement, the feature is a big swing aimed at protecting a small minority of the most vulnerable and highly targeted groups around the world—including activists, journalists, and politicians—while also adding defense for all users of new devices. To that end, the company announced on Friday that it will donate a thousand iPhone 17s to rights groups that work with people at risk of facing targeted digital attacks.

    “You can say, well, that seems like a very large effort to protect only that very small number of users that are being targeted by mercenary spyware, but there is just this incontrovertible track record described by journalists, tech companies, and civil society organizations that these technologies are constantly being abused,” Krstić says. “And we feel a great moral obligation to defend those users. Despite the fact that the vast majority of our users will never be targeted by anything like this, this work that we did will end up increasing protection for everyone.”

    [ad_2]

    Lily Hay Newman

    Source link

  • Where Do Your Passwords Go When You Die?

    [ad_1]

    It’s not fun to talk about, but there’s only one thing certain in life. You need to have a plan for your digital legacy, just like you make a plan for your physical assets; otherwise, your accounts, services, and logins will rot away in a data center before they’re inevitably erased by a data retention policy.

    Some services recognize how important digital legacy is. Apple and Facebook have legacy contacts that can gain access to your accounts, and the American Bar Association is still grappling with the legalities of accessing online accounts when someone passes away. Most online services don’t.

    Recognition of digital legacy is still spotty, and without dedicated legacy contacts, accessing the deceased’s online accounts often involves court orders or legal documentation (and plenty of time). Digital legacy doesn’t need to have so many hurdles, though. Password managers have digital legacy features built in that can unlock your digital life in the event of an emergency.

    Table of Contents

    Defining a Digital Legacy

    There’s a lot that goes into your digital legacy, from your online banking login to any digital assets you own, but even a seemingly straightforward online life can quickly snowball into a mess. Does the Netflix account just keep draining the checking account until you can break in and change the payment option? Are photos that have been uploaded to the cloud now lost in a data center, never to be recovered? Add some passkeys, maybe some social sign-on features, and you have a complex web of data that’s almost impossible to untangle.

    So-called digital executors exist, operating in the same way as the executor of the will, just for digital assets. It’s a good idea to set up a digital executor to ensure your digital assets are handled properly, but that doesn’t help in the immediate aftermath of someone passing away. The probate process can take at least a few months, and sometimes several years.

    Password managers like Bitwarden offer a shortcut. You can transfer access to a trusted relative, spouse, or even your closest friend, along with a rundown of what to do with your accounts.

    The legality of this is a little murky, with the American Bar Association noting that accessing someone else’s account, even with their username and password, isn’t legal if it violates the platform’s terms of service. The law regarding digital assets varies from state to state, so it’s still a good idea to consult an attorney for long-term access.

    Here’s the advice NordPass gave: “For anyone thinking about digital legacy, the best step is to set up Emergency Access in advance, clearly communicate the use cases of the credentials with your trusted contacts, and follow the terms of service of respective platforms.”

    Immediate access is still important, not only in the event of death but also in the event of incapacitation. If you, for whatever reason, can’t access your online accounts, you can transfer those accounts easily using an emergency contact feature available in a password manager.

    Password Managers With Digital Legacy Features

    There are some excellent password managers, and most of them have some way to unlock your account in the event of an emergency. They go about it in different ways, however. Here are the three I recommend for most people. (Read more in our Best Password Managers guide.)

    Proton Pass

    Courtesy of Proton

    Proton recently added an emergency access feature, and it’s not just restricted to Proton Pass. Unlike most password managers, Proton Pass is just one app available in the Proton suite. Proton also makes our favorite VPN, and it offers an encrypted crypto wallet, cloud storage, and even a calendar.

    Emergency access isn’t restricted to one app with Proton. Rather, it’s access to your entire account, so if you have multiple Proton apps, you can pass them along. It’s not hard to see where this could be useful, especially if you have a lot of data stored in Proton Drive or money in your crypto wallet.

    [ad_2]

    Jacob Roach

    Source link

  • 1Password Is Still the Gold Standard for Securely Managing Your Passwords

    [ad_1]

    Password managers are spotty on Android and iOS in general, and 1Password isn’t above that issue. I’d estimate somewhere around 10 to 15 percent of the fields I encounter on mobile just don’t register with 1Password, sending me out to the app to copy my password over manually. This is more of an issue with how apps categorize different fields and expose them to other apps running, and less of a 1Password-specific problem.

    1Password at least attempts to get around this with linked apps. As you start signing into apps using entries in your vault, 1Password will connect your login to whatever app you’re logging into. That doesn’t eliminate autofill problems on mobile, but it helps in the cases where 1Password is looking for a specific URL to autofill, and the mobile app isn’t operating with that URL.

    Outside of autofill, using 1Password on Android and iOS is a breeze. You can enter your account password each time you unlock your account if you want, but 1Password supports biometric authentication on Android and iOS, including Face ID support. After a certain amount of time has passed (you can change the amount of time in the settings), 1Password will ask you to re-enter your account password. Thankfully, if you don’t want to use biometrics, you can set up a PIN or passcode, as well.

    Quick access is important because 1Password is extremely limited on mobile, and that’s a good thing. Even switching to another app or locking your phone will also lock your account, and if you swipe through your list of open apps, you’ll only see the 1Password login screen.

    You’re free to change these settings, from the amount of time you need to re-enter your account password to when 1Password should clear your keyboard history. The defaults work well, but if you can’t be bothered, you can turn these extra security measures off.

    Unique Security

    1Password may function similarly to other password managers, but its security design is unique. The company has a white paper you can read through for all the gory details, and it maintains a list of certifications and recent penetration testing. The core of 1Password’s security, however, is a zero-knowledge approach. It’s designed in such a way that, even if 1Password wanted to, it has no means to decrypt the contents of your vault.

    This works due to what 1Password calls two-secret key derivation, or 2SKD. It takes your account password and a secret key that’s generated on your device when you first sign up for 1Password, and uses them to derive a key encryption key (KEK). Also on your device, 1Password generates a public-private key pair. Your private key is encrypted with the KEK, while your public key is shared.

    There are several layers of nested encryption beyond this, but what’s important is that 1Password doesn’t have a copy of your private key, nor a copy of your account password that’s necessary to derive the KEK. And when you authenticate, everything happens locally on your device, including encryption and decryption. Your KEK, master password, and private key never leave your device.

    [ad_2]

    Jacob Roach

    Source link

  • I Tried Breaking the Best VPNs. Here Are the 5 That Survived

    [ad_1]

    Other VPNs We’ve Tested

    Private Internet Access (PIA) has a long history in the VPN space, and it’s maintained a track record of defending user privacy—even in the face of actual criminal activity. In 2016, a criminal complaint was filed in Florida against Preston Alexander McWaters for threats made online. McWaters was eventually convicted and sentenced to 42 months in prison. Investigators traced the online threats back to PIA’s servers and subpoenaed the company. As the complaint reads, “A subpoena was sent to [Private Internet Access] and the only information they could provide is that the cluster of IP addresses being used was from the east coast of the United States.” McWaters engaged in several other identifying activities, according to the complaint, but PIA wasn’t among them. Despite such a clear view of a VPN provider upholding its no-logging policy, PIA didn’t impress me during my tests. It’s slightly more expensive than a lot of our top picks, and it delivered the worst speeds out of any VPN I tested, with more than a 50 percent drop on the closest US server. (Windscribe, for context, only dropped 15.6 percent of my speed.)

    MysteriumVPN is the go-to dVPN, or decentralized VPN, as far as I can tell. The concept of a decentralized VPN has existed for a while, but it’s really gained traction over the last couple of years. The idea is to have a network of residential IP addresses that make up the network, routing your traffic through normal IP addresses to get around the increasingly common block lists for VPN servers. Mysterium accomplishes this network with MystNodes. It’s a crypto node. People buy the node to earn crypto, and they’re put into the Mysterium network. It’s not inherently bad, but routing your traffic through a single residential IP is a little worrisome. Even without the decentralized kick, Mysterium was slow, and it doesn’t maintain any sort of privacy materials, be it a third-party audit, warranty canary, or transparency report.

    PrivadoVPN is one of the popular options to recommend as a free VPN. It offers a decent free service, with a handful of full-speed servers and 10 GB of data per month. You’ll have to suffer through four—yes, four—redirects begging you to pay for a subscription before signing up, but the free plan works. The problem is how new PrivadoVPN is. There’s no transparency report or audit available, and although the speeds are decent, they aren’t as good as Proton, Windscribe, or Surfshark. PrivadoVPN isn’t bad, but it’s hard to recommend when Proton and Windscribe exist with free plans that are equally as good.

    How We Test VPNs

    Functionally, a VPN should do two things: keep your internet speed reasonably fast, and actually protect your browsing data. That’s where I focused my testing. Extra features, a comfy UI, and customization settings are great, but they don’t matter if the core service is broken.

    Speed testing requires spot-checking, as the time of day, the network you’re connected to, and the specific VPN server you’re using can all influence speeds. Because of that, I always set a baseline speed on my unprotected connection directly before recording results, and I ran the test three times across both US and UK servers. With those baseline drops, I spot-checked at different times of the day over the course of a week to see if the speed decrease was similar.

    Security is a bit more involved. For starters, I checked for DNS, WebRTC, and IP leaks every time I connected to a server using Browser Leaks. I also ran brief tests sniffing my connection with Wireshark to ensure all of the packets being sent were secured with the VPN protocol in use.

    On the privacy front, the top-recommended services included on this list have been independently audited, and they all maintain some sort of transparency report. In most cases, there’s a proper report, but in others, such as Windscribe, that transparency is exposed through legal proceedings.

    [ad_2]

    Jacob Roach

    Source link

  • Cindy Cohn Is Leaving the EFF, but Not the Fight for Digital Rights

    [ad_1]

    After a quarter century defending digital rights, Cindy Cohn announced on Tuesday that she is stepping down as executive director of the Electronic Frontier Foundation. Cohn, who has led the San Francisco–based nonprofit since 2015, says she will leave the role later this year, concluding a chapter that helped define the modern fight over online freedom.

    Cohn first rose to prominence as lead counsel in Bernstein v. Department of Justice, the 1990s case that overturned federal restrictions on publishing encryption code. As EFF’s legal director and later executive director, she guided the group through legal challenges to government surveillance, reforms to computer crime laws, and efforts to hold corporations accountable for data collection. Over the past decade, EFF has expanded its influence, becoming a central force in shaping the debate over privacy, security, and digital freedom.

    In an interview with WIRED, Cohn reflected on EFF’s foundational encryption victories, its unfinished battles against National Security Agency (NSA) surveillance, and the organization’s work protecting independent security researchers. She spoke about the shifting balance of power between corporations and governments, the push for stronger state-level privacy laws, and the growing risks posed by artificial intelligence.

    Though stepping down from leadership, Cohn tells WIRED she plans to remain active in the fight against mass surveillance and government secrecy. Describing herself as “more of a warrior than a manager,” she says her intent is to return to frontline advocacy. She is also at work on a forthcoming book, Privacy’s Defender, due out next spring, which she hopes will inspire a new generation of digital rights advocates.

    This interview has been edited for length and clarity.

    WIRED: Tell us about the fights you won, and the ones that still feel unfinished after 25 years.

    CINDY COHN: The early fight that we made to free up encryption from government regulation still stands out as setting the stage for a potentially secure internet. We’re still working on turning that promise into a reality, but we’re in such a different place than we would’ve been in had we lost that fight. Encryption protects anybody who buys anything online, anyone who uses Signal to be a whistleblower or journalists, or just regular people who want privacy and use WhatsApp or Signal. Even the backend-certificate authorities provided by Let’s Encrypt—that make sure that when you think you’re going to your bank, you’re actually going to your bank website—are all made possible because of encryption. These are all things that would’ve been at risk if we hadn’t won that fight. I think that win was foundational, even though the fights aren’t over.

    The fights that we’ve had around the NSA and national security, those are still works in progress. We were not successful with our big challenge to the NSA spying in Jewel v. NSA, although over the long arc of that case and the accompanying legislative fights, we managed to claw back quite a bit of what the NSA started doing after 9/11.

    [ad_2]

    Dell Cameron

    Source link

  • The New Math of Quantum Cryptography

    [ad_1]

    The original version of this story appeared in Quanta Magazine.

    Hard problems are usually not a welcome sight. But cryptographers love them. That’s because certain hard math problems underpin the security of modern encryption. Any clever trick for solving them will doom most forms of cryptography.

    Several years ago, researchers found a radically new approach to encryption that lacks this potential weak spot. The approach exploits the peculiar features of quantum physics. But unlike earlier quantum encryption schemes, which only work for a few special tasks, the new approach can accomplish a much wider range of tasks. And it could work even if all the problems at the heart of ordinary “classical” cryptography turn out to be easily solvable.

    But this striking discovery relied on unrealistic assumptions. The result was “more of a proof of concept,” said Fermi Ma, a cryptography researcher at the Simons Institute for the Theory of Computing in Berkeley, California. “It is not a statement about the real world.”

    Now, a new paper by two cryptographers has laid out a path to quantum cryptography without those outlandish assumptions. “This paper is saying that if certain other conjectures are true, then quantum cryptography must exist,” Ma said.

    Castle in the Sky

    You can think of modern cryptography as a tower with three essential parts. The first part is the bedrock deep beneath the tower, which is made of hard mathematical problems. The tower itself is the second part—there you can find specific cryptographic protocols that let you send private messages, sign digital documents, cast secret ballots, and more.

    In between, securing those day-to-day applications to mathematical bedrock, is a foundation made of building blocks called one-way functions. They’re responsible for the asymmetry inherent in any encryption scheme. “It’s one-way because you can encrypt messages, but you can’t decrypt them,” said Mark Zhandry, a cryptographer at NTT Research.

    In the 1980s, researchers proved that cryptography built atop one-way functions would ensure security for many different tasks. But decades later, they still aren’t certain that the bedrock is strong enough to support it. The trouble is that the bedrock is made of special hard problems—technically known as NP problems—whose defining feature is that it’s easy to check whether any candidate solution is correct. (For example, breaking a number into its prime factors is an NP problem: hard to do for large numbers, but easy to check.)

    Many of these problems seem intrinsically difficult, but computer scientists haven’t been able to prove it. If someone discovers an ingenious algorithm for rapidly solving the hardest NP problems, the bedrock will crumble, and the whole tower will collapse.

    Unfortunately, you can’t simply move your tower elsewhere. The tower’s foundation—one-way functions—can only sit on a bedrock of NP problems.

    To build a tower on harder problems, cryptographers would need a new foundation that isn’t made of one-way functions. That seemed impossible until just a few years ago, when researchers realized that quantum physics could help.

    [ad_2]

    Ben Brubaker

    Source link

  • These are the Password Managers You Should Use Instead of Your Browser

    [ad_1]

    Setting up and migrating to Dashlane from another password manager is simple, and you’ll use a secret key to encrypt your passwords, much like BitWarden’s setup process. In practice, Dashlane is very similar to the others on this list. Dashlane offers a 30-day free trial, so you can test it out before committing.

    After signing up, download the app for Android and iOS, and grab the browser extensions for Firefox, Chrome, and Edge.

    Best for Bundled Services

    Photograph: Nordpass

    You might know Nord better for its VPN service, but the company also offers a password manager, NordPass, and a pretty nice online storage system, NordLocker. A part of the appeal of NordPass comes in bundling it with the company’s other services for some compelling deals. As a password manager, NordPass offers everything you need. It uses a zero-knowledge setup in which all data is encrypted on your device before it’s uploaded to the company’s servers. Unlike most services here, NordPass uses XChaCha20 for encryption. It would require a deep dive into cryptography to get into the differences, but the short story is that it’s just as secure and maybe slightly faster than the AES-256 encryption used by other services.

    There’s a personal information storage feature to keep your address, phone number, and other personal data safe and secure, but easy to access. NordPass also offers an emergency access feature, which allows you to grant another NordPass user emergency access to your vault. It works just like the same feature in 1Password, allowing trusted friends or family to access your account if you cannot.

    Other nice features include support for two-factor authentication to sign in to your account, as well as security tools to evaluate the strength of your passwords and alert you if any of your data is compromised. Note that NordPass Premium is theoretically $3 a month, but there are always sales that bring that much lower.

    The downside, and my one gripe about all Nord services, is that there is no monthly plan. As noted above, the best deal comes in combining NordPass, NordVPN, and NordLocker for a bundled deal. A free version of NordPass is available, but it’s restricted to only a single device.

    After signing up, download the app for Android and iOS, and grab the browser extensions for Firefox, Chrome, and Edge.

    Best DIY Options (Self-Hosted)

    Want to retain more control over your data in the cloud? Sync your password vault yourself. The services below do not store any of your data on their servers. This means attackers have nothing to target. Instead of storing your passwords, these services use a local vault to store your data, and then you can sync that vault using a file-syncing service like Dropbox, NextCloud, or Edward Snowden’s recommended service, SpiderOak. There are two services to keep track of in this scenario, making it a little more complex. But if you’re already using a file-syncing file service, this can be a good option.

    You can also properly host your own vault with network-attached storage or a local server.

    Screenshot of Enpass password manager app on desktop

    Courtesy of Enpass

    Enpass does not store any data on its servers. Syncing is handled through third-party services. Enpass doesn’t do the syncing, but it does offer apps on every platform. That means once you have syncing set up, it works just like any other service. And you don’t have to worry about Enpass being hacked, because your data isn’t on its servers. Enpass supports syncing through Dropbox, Google Drive, OneDrive, iCloud, Box, Nextcloud, or any service using WebDAV. Alas, SpiderOak is not currently supported. You can also synchronize your data over a local WLAN or Wi-Fi network.

    All of the features you expect in a password manager are here, including auto-generating passwords, breach-monitoring, biometric login (for devices that support it), auto-filling passwords, and options to store other types of data, like credit cards and identification data. There’s also a password audit feature to highlight any weak or duplicate passwords in your vault. One extra I particularly like is the ability to tag passwords for easier searching. Enpass also makes setting up the syncing through the service of your choice very easy. Enpass added support for passkeys, too.

    [ad_2]

    Scott Gilbertson, Jacob Roach

    Source link

  • The FBI Still Hasn’t Cracked NYC Mayor Eric Adams’ Phone

    The FBI Still Hasn’t Cracked NYC Mayor Eric Adams’ Phone

    [ad_1]

    Pig butchering, the crypto-based scammer scourge that has pulled in an estimated $75 billion from victims globally, is spreading beyond its roots in Southeast Asia, with operations proliferating across the Middle East, Eastern Europe, Latin America, and West Africa.

    The UK’s National Crime Agency disclosed new details about the identities of the Russian ransomware group known as Evil Corp—as well as the group’s ties to Russian intelligence agencies and even its direct participation in espionage operations targeting NATO allies.

    A WIRED investigation revealed how car-mounted automatic license plate reader cameras are capturing far more than just license plates, including campaign yard signs, bumper stickers, and other politically sensitive text, all examples of how a system for tracking vehicles threatens to become a broader surveillance tool.

    In other news, ICE signed a $2 million contract with Paragon Solutions, a known vendor of spyware including the hacking tool Graphite. And the Pentagon is increasingly adopting handheld controllers for weapons systems in an effort provide more intuitive interfaces to soldiers who have grown up playing Xbox and PlayStation consoles.

    And there’s more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    As the politics of America’s biggest city have been turned upside down by the criminal charges against New York mayor Eric Adams, there’s still a “significant wild card” in the corruption case against him, prosecutors said in court this week: The FBI can’t manage to get into his phone.

    Prosecutors in the case against Adams, which centers on alleged illegal payments the mayor received from the Turkish government, revealed that the FBI still hasn’t cracked the encryption on Adams’ personal phone, nearly a year after it was seized. That phone is one of three that the bureau has taken from Adams, but agents seized Adams’ personal phone a day later than the other two devices he used in an official capacity. By that time, Adams had not only changed the passcode on the phone from a four digit PIN to six digits—a measure he says he took to prevent staffers from intentionally or unintentionally deleting information from the device. He also claims he immediately “forgot” that code to unlock it.

    That very convenient amnesia may leave the FBI and prosecutors in a situation similar to their investigation into the San Bernardino mass shooting carried out by Syed Rizwan Farook in 2016, when the US government demanded Apple help unlock the shooter’s encrypted iPhone, leading to a high-profile standoff between the Apple and the FBI. In that case, the cybersecurity firm Azimuth eventually used a closely guarded—and expensive—hacking technique to unlock the device. In Adams’ case, prosecutors hinted that the FBI may have to resort to similar measures. “Decryption always catches up with encryption,” a prosecutor in the case, Hagan Scotten, told the judge.

    Face recognition is one of only a few technologies that even Facebook and Google have hesitated to integrate into products like Google Glass and the Ray-Ban Meta smart glasses—and rightly so, given the privacy implications of a device that would allow anyone to look at a stranger on the street and immediately determine their phone number and home address. Now, however, a group of Harvard students has shown how easy it is to bolt that face recognition onto Meta’s augmented-reality eyewear. The project, known as I-XRAY, integrates with the face-recognition service Pimeyes to let Ray-Ban Meta wearers learn the name of virtually anyone they see and then immediately scour databases of personal information to determine other info about them, including names of family members, phone numbers, and home addresses. The students say they’re not releasing the code for their experiment, instead intending it as a demonstration of the privacy-invasive potential of augmented-reality devices. Point made.

    If that warning about the privacy risks of AR eyewear needed more reinforcement, Meta this week also conceded to TechCrunch that it will use input from users’ smart glasses to train its AI products. Initially, Meta declined to answer TechCrunch’s questions about whether and how it would collect information from Ray-Ban Meta smart glasses for use as AI training data, in contrast to companies like OpenAI and Anthropic that explicitly say they don’t exploit user inputs to train their AI services. A couple of days later, however, Meta confirmed to TechCrunch that it does in fact use images or video collected through its smart glasses to train its AI, but only if the user submits them to Meta’s AI tools. That means anything that a user sees and asks Meta’s AI chatbot to comment on or analyze will become part of Meta’s massive AI-training data trove.

    If you can’t arrest Russian hackers, at least you can nab their web domains. That, at least, is the approach this week of the US Justice Department, which along with Microsoft and the NGO Information Sharing and Analysis Center used a lawsuit to take control of more than a hundred web domains that had been used by Russian hackers working for the Kremlin’s intelligence and law enforcement agency known as the FSB. Those domains had been exploited in phishing campaigns by the Russian hacker group known as Star Blizzard, which has a history of targeting the typical victims of geopolitical spying such as journalists, think tanks, and NGOs. The domain seizures seem designed in part to head off threats of foreign interference in next month’s US election. “Rebuilding infrastructure takes time, absorbs resources, and costs money,” Steven Masada, the assistant general counsel of Microsoft’s Digital Crimes Unit, said in a statement. “Today’s action impacts [the hackers’] operations at a critical point in time when foreign interference in US democratic processes is of utmost concern.”

    [ad_2]

    Andy Greenberg

    Source link

  • Neo-Nazis Are Fleeing Telegram for Encrypted App SimpleX Chat

    Neo-Nazis Are Fleeing Telegram for Encrypted App SimpleX Chat

    [ad_1]

    Dozens of neo-Nazis are fleeing Telegram and moving to a relatively unknown secret chat app that has received funding from Twitter founder Jack Dorsey.

    In a report from the Institute for Strategic Dialogue published on Friday morning, researchers found that in the wake of the arrest of Telegram founder Pavel Durov and charges against leaders of the so-called Terrorgram Collective, dozens of extremist groups have moved to the app SimpleX Chat in recent weeks over fears that Telegram’s privacy policies expose them to being arrested. The Terrorgram Collective is a neo-Nazi propaganda network that calls for acolytes to target government officials, attack power stations, and murder people of color.

    While ISD stopped short of naming SimpleX in its report, the researchers point out that the app promotes itself as “having a different burner email or phone for each contact, and no hassle to manage them.” This is exactly how SimpleX refers to itself on its website.

    Last month, one accelerationist group linked to the now defunct neo-Nazi terrorist group Atomwaffen Division, with more than 13,000 subscribers on Telegram, began migrating to SimpleX. Administrators of the channel advised subscribers that “while it’s not as smooth as Telegram, it appears to be miles ahead with regard to privacy and security.”

    The group now has 1,000 members on SimpleX and, according to ISD, is “part of a wider network built by neo-Nazi accelerationists that consists of nearly 30 channels and group chats,” which includes other well-known accelerationist groups like the Base. Accelerationists seek to speed up the downfall of Western society by triggering a race war in order to rebuild civilization based on their own white Christian values.

    The network of groups on SimpleX are also sharing extremist content, including al-Qaeda training manuals, Hamas rocket development guides, neo-Nazi accelerationist handbooks, and militant anarchist literature. And in their newly secure channels on SimpleX, the members of the groups have immediately made direct calls for violence.

    “During a 24-hour period on September 25, analysts observed three instances of users calling for the assassination of Vice President Kamala Harris, and one instance calling for the assassination of former President Donald Trump,” the ISD researchers wrote. “Similarly, numerous users called for a race war that would hasten the fall of society, allow them to take the US by force, and institute their desired system of white supremacy.”

    SimpleX Chat is an app that was founded by UK-based developer Evgeny Poberezkin. It was initially launched in 2021, and a blog post in August announced that it had passed 100,000 downloads on Google’s Play store. The same blog post announced that Dorsey had led a $1.3 million investment round, having previously praised the app on other social media platforms. Dorsey did not reply to a request for comment.

    For years, neo-Nazi groups have flourished on Telegram, many of them under the assumption that Telegram was a fully encrypted platform that provided a greater level of security than it really did. Telegram was used by these groups for building out their networks, sharing propaganda, and planning attacks. However, two of the leaders of the Terrorgram Collective were arrested and charged last month, which was a key factor in triggering the migration to SimpleX, the ISD analysts wrote. The group used Telegram to encourage acts of terrorism in the US and overseas.

    [ad_2]

    David Gilbert

    Source link

  • Graid Technology Inc. and KLC Group Forge Groundbreaking Partnership to Redefine High-Speed RAID and Data-at-Rest Security

    Graid Technology Inc. and KLC Group Forge Groundbreaking Partnership to Redefine High-Speed RAID and Data-at-Rest Security

    [ad_1]

    Protecting enterprise and military servers with unmatched NVMe RAID performance and the most advanced cybersecurity encryption on the market.


    SANTA CLARA, Calif., October 1, 2024 (Newswire.com)
    –
    As data demands surge in today’s hyper-competitive landscape, organizations are constantly seeking solutions that balance cutting-edge security with uncompromised performance. A new strategic partnership between Graid Technology, creators of SupremeRAID™, and KLC Group, innovators behind CipherDriveOne Plus, is set to redefine this balance with a first-of-its-kind solution for high-speed storage and NSA CSfC-certified Data-at-Rest (DAR) Security.

    At the core of this collaboration is a novel approach to data security. Combining the National Security Agency’s (NSA) Commercial Solutions for Classified (CSfC) Data-at-Rest (DAR) Security guidelines, the joint solution integrates encryption, access controls, and authentication to deliver military-grade data protection. This breakthrough is designed to meet the critical needs of government contractors and organizations that require NSA CSfC-certified protection alongside high-performance RAID storage.

    While CipherDriveOne Plus provides robust hardware-based full-disk encryption, traditional RAID solutions have presented challenges, including drive-locking mechanisms that limit the performance of CSfC-compliant NVMe SSDs or spinning disks. SupremeRAID™ by Graid Technology offers a groundbreaking alternative. As a GPU-accelerated software RAID, SupremeRAID™ eliminates the bottlenecks and limitations of hardware RAID, allowing CSfC-compliant systems like CipherDriveOne Plus to operate without compromising authentication processes or drive performance. This results in superior data protection and seamless NVMe SSD operation.

    CipherDriveOne Plus, a Hardware Full Disk Encryption – Authorization Acquisition (AA) solution, is designed to meet the U.S. Government’s strict Data-at-Rest (DAR) standards. It provides key management, encryption, and authentication over OPAL 2.0 self-encrypting SSDs or HDDs, ensuring immediate data protection that is OS-agnostic and governed by FIPS-140-2 level key encryption with options for single, two-factor, or multi-factor authentication.

    “We are thrilled to embark on this new journey with our esteemed partner, where innovation meets collaboration. Together, we have achieved remarkable milestones and won several government customers in a short time. There is no other solution capable of our joint technology in the market today,” said Kurt Lennartsson, CEO of KLC Group.

    “By joining forces with KLC Group, we are redefining the performance and security benchmarks in high-performance computing, AI, and diverse industries reliant on data-intensive operations,” stated Leander Yu, President and CEO of Graid Technology. “The collaboration between SupremeRAID™ and CipherDriveOne Plus not only enhances performance but also ensures comprehensive data protection, scalability, and flexibility.”

    To explore the advanced data protection and storage performance offered by this partnership, download the solution brief.

    For more information:

    __________________________________________________

    About KLC Group and CipherDriveOne 
    KLC Group is a leading provider of cybersecurity solutions, dedicated to safeguarding organizations from evolving cyber threats. With a focus on innovation and excellence, KLC Group has consistently delivered cutting-edge security solutions tailored to meet the unique needs of its clients. Learn more: www.klc-group.com

    About Graid Technology and SupremeRAID™ 
    Graid Technology is led by a dedicated team of experts with decades of experience in the SDS, ASIC, and storage industries, and continues to push boundaries in data storage innovation by protecting NVMe-based data from the desktop to the cloud. Cutting-edge SupremeRAID™ GPU-based RAID removes the traditional RAID bottleneck to deliver maximum SSD performance without consuming CPU cycles or creating throughput bottlenecks, delivering unmatched flexibility, performance, and value. With headquarters in Silicon Valley supported by a robust R&D center in Taiwan, we are globally committed to spearheading advancements in storage solutions. For detailed product information, visit our website, or connect with us on Twitter (X) or LinkedIn.

    Source: Graid Technology Inc.

    [ad_2]

    Source link

  • Hackers Threaten to Leak Planned Parenthood Data

    Hackers Threaten to Leak Planned Parenthood Data

    [ad_1]

    Even those of you who do everything you can to secure those secrets can find yourself vulnerable—especially if you’re using a YubiKey 5 authentication token. The multifactor authentication devices can be cloned thanks to a cryptographic flaw that can’t be patched. The company has rolled out some mitigation measures—and the attack itself is relatively difficult to pull off. But it may be time to invest in a new dongle.

    That’s not all, folks. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    At the end of August, cybercriminals from the ransomware group RansomHub appear to have hacked into the systems of Planned Parenthood’s Montana branch. The organization this week confirmed it had suffered from a “cybersecurity incident” on August 28 and said its staff immediately took parts of its network offline, reporting the incident to law enforcement.

    Days after the incident took place, RansomHub claimed to be behind the attack, posting Planned Parenthood on its leak website. The criminal group said it would publish 93 GB of data. It is unclear what, if anything, the ransomware group has obtained, but Planned Parenthood clinics can hold a huge array of highly sensitive data about patients, including information on abortion appointments. (Around 400,000 Planned Parenthood patients in Los Angeles were impacted following a similar ransomware incident in 2021.)

    In recent months, RansomHub has emerged as one of the most active ransomware-as-a-service groups, following the law enforcement disruption of LockBit. According to an FBI and Cybersecurity and Infrastructure Security Agency alert at the end of August, the group is “efficient and successful” and has stolen data from at least 210 victims since it formed in February. “The affiliates leverage a double-extortion model by encrypting systems and exfiltrating data to extort victims,” the alert said.

    The Nigeria-based scammers known as the Yahoo Boys run almost every scam in the playbook—from romance scams to pretending to be FBI agents. Yet there’s little-more devious than the increase in sextortion cases linked to the West African scammers. This week, Nigerian brothers Samuel Ogoshi and Samson Ogoshi were sentenced to more than 17 years in US jail for running sextortion scams, following their extradition earlier this year. It is the first time Nigerian scammers have been prosecuted for sextortion in the US, the BBC reported.

    The Ogoshi brothers, who pleaded guilty in April, have been linked to the death of 17-year-old Jordan DeMay, who took his life six hours after he started talking to the scammers, who posed as a girl, on Instagram. The teenager had been duped into sending the brothers explicit images, and after he had done so, they threatened to post the images online unless he paid them hundreds of dollars. US prosecutors said the brothers sexually exploited and extorted more than 100 victims, with at least 11 of them being minors. There has been a huge spike in sextortion cases in recent years.

    In June, the US Commerce Department banned the sale of Kaspersky’s antivirus tools over national security concerns about its links to the Russian government. (Kaspersky has, for years, denied connections). The firm later fired its workers and said it was closing its US business. This week, cybersecurity company Pango Group announced it is purchasing Kaspersky Lab’s US antivirus customers, according to Axios. This equates to around 1 million customers, who will be transitioned to Pango’s antivirus software Ultra AV. Ahead of the Kaspersky deal, parent company Aura also announced it was spinning out Pango Group into its own business. Pango’s president said customers would not need to take any action and that it would allow subscribers to continue to receive updates after September 29, when Kaspersky updates will stop.

    For years, the EU has been trying to introduce new child protection laws that would require private chats to be scanned for child sexual abuse material—something that would potentially undermine encrypted messaging apps that provide everyday privacy to billions of people. The plans have been highly controversial and were shelved earlier this year. However, the proposed law, which has been dubbed “chat control,” reappeared in legislators’ in-trays this week. The Council of the EU, which is currently chaired by Hungary, wants to pass legislation by October, but reports say strong resistance to the plans still remain.

    [ad_2]

    Matt Burgess, Andrew Couts

    Source link

  • The NSA Has a Podcast—Here’s How to Decode It

    The NSA Has a Podcast—Here’s How to Decode It

    [ad_1]

    The spy agency that dared not speak its name is now the Joe Rogan of the SIGINT set. And the pod’s actually worth a listen.

    [ad_2]

    Steven Levy

    Source link

  • Germany’s Far Right Is in a Panic Over Telegram

    Germany’s Far Right Is in a Panic Over Telegram

    [ad_1]

    Soon after the arrest of Telegram founder and CEO Pavel Durov, a warning that was viewed more than 85,000 times started circulating among Germany’s far right: “Back up your Telegram data as quickly as you can and clean your account.”

    The message came from Kim Dotcom, the embattled German founder of the now-defunct digital piracy website Megaupload who is set to be extradited from New Zealand, and who knows a thing or two about facing penalties for illegal activity on the internet.

    Telegram users may have reason to fear after French authorities threw the book at Durov, charging him with complicity in crimes that take place on the app, including the sharing of child pornography and the trading of narcotics. If Durov can be held liable for crimes on the app, so too can the criminals perpetrating them, the logic goes.

    Researchers at Germany’s Center for Monitoring, Analysis, and Strategy (CeMAS) track around 3,000 channels and 2,000 groups linked to the German far right and conspiracy movements. Users are known to post racist and antisemitic hate speech, and some groups contain Nazi symbols, Holocaust denial, and calls to violence, openly flouting Germany’s strict criminal code. But a mass exodus from the platform, where groups have spent the past five years building a global infrastructure for radicalization and offline demonstrations, would be tantamount to starting from scratch online.

    “If you’re a terrorist or you’re an extremist, you’re going to follow the path of least resistance, and in this particular case, that probably means Telegram,” Adam Hadley, the founder and executive director of the United Nations–backed organization Tech Against Terrorism, tells WIRED.

    Durov’s arrest is a shot across the bow for Telegram, which now suddenly finds itself in the sights of European law enforcement and regulators. Neo-Nazis’ favorite app is staring down an existential threat, and they’re not quite sure what to do about it.

    A ‘Bridge Technology’

    Alarm spread quickly the Saturday of Durov’s arrest. Just 90 minutes after French media reported that Durov’s private jet had been intercepted by authorities at Paris’ Le Bourget Airport, a far-right channel posted that his arrest “may have political reasons and be a tool to gain access to personal data of Telegram users.”

    The channel is associated with the Reichsbürger movement, which believes Germany is not a sovereign state and is still occupied by Allied powers. German police thwarted their coup plot in 2022, discovering a cache of more than $500,000 in gold and cash, as well as hundreds of guns, knives, ballistic helmets, and ammunition rounds.

    Similar messages began proliferating across the app. That night, Austrian extremist Martin Sellner wrote—the translation here is via Google’s translation tool—that “the ‘liberal West’ is switching off the democracy simulation. All communication channels may soon collapse. Will Musk be arrested next?” The message was viewed more than 40,000 times as estimated by TGStat, a Telegram analytics tool, which provided the view counts cited in this story.

    Sellner was banned from entering Germany in March for being the keynote speaker at the far-right Alternative für Deutschland (AfD) Party’s ill-famed November Potsdam conference. There, he presented a plan to members of Germany’s surging far-right party on conducting mass deportations once it came into power. AfD emerged victorious Sunday in a state election in eastern Germany, granting the far right a historic first since World War II.

    [ad_2]

    Josh Axelrod

    Source link

  • Telegram Faces a Reckoning. Other Founders Should Beware

    Telegram Faces a Reckoning. Other Founders Should Beware

    [ad_1]

    “[Elon] Musk and fellow executives should be reminded of their criminal liability,” said Bruce Daisley, a former executive at Twitter, who worked at the company’s British office, days after British protesters tried to set fire to a hotel for asylum seekers.

    But Telegram has provoked politicians more than any other platform. What could be called the company’s uncollaborative approach has put the platform—part messaging app, part social media network—on a collision course with governments around the world.

    The case in France is far from the first time Telegram has been reprimanded by authorities for its refusal to cooperate. Telegram has been temporarily suspended twice in Brazil, in 2022 and 2023, both times after being accused of failing to cooperate with legal orders.

    In 2022, similar events unfolded in Germany when the country’s interior minister also threatened to ban the app after letters, suggestions of fines, and even a Telegram-dedicated task force all went unanswered, according to the authorities, who were concerned about anti-lockdown groups using the app to discuss political assassinations. Multiple German newspapers, including the tabloid Bild, sent journalists to the office Telegram states as its headquarters in Dubai and found it deserted, its doors locked.

    Earlier in 2024, Spain briefly blocked Telegram after broadcasters claimed copyrighted material was circulating on the app. Judge Santiago Pedraz of Spain’s National High Court said his decision to ban was based on Telegram’s lack of cooperation with the case.

    The accusations in France are very specific to Telegram’s way of working, says Arne Möhle, cofounder of encrypted email service Tuta. “Of course it’s important to be independent but at the same time, it’s also important to comply with authority requests if they are valid,” he says. “It’s important to show [criminal activities are] something you don’t want to support with your privacy-oriented service.”

    France’s decision to charge Durov is a rare move to link a tech executive to crimes taking place on their platform, but it is not without precedent. Durov joins the ranks of the founders of The Pirate Bay, who were sentenced by Swedish authorities to a year in prison in 2009; and the German-born founder of MegaUpload, Kim Dotcom, who finally lost a 12-year battle to be extradited to the US from his home in New Zealand in August. He plans to appeal.

    Yet Durov is the first of his generation of founders behind major social media platforms to face such severe consequences. What happens next will carry lessons for them all.

    Bastien Le Querrec, legal officer at French digital freedom group La Quadrature du Net, does not defend Telegram’s lack of moderation. But he is concerned that the case against Durov reflects the huge pressure both social media and messaging apps are under right now to collaborate with law enforcement.

    “[The prosecutor] refers to a provision in French law that requires platforms to disclose any useful document that could allow law enforcement to do interception of communication,” he says. “To our knowledge, it’s the first time that a platform, whatever its size, would be prosecuted [in France] because it refused to disclose such documents. It’s a very worrying precedent.”

    [ad_2]

    Morgan Meaker

    Source link

  • Telegram CEO Pavel Durov’s Arrest Linked to Sweeping Criminal Investigation

    Telegram CEO Pavel Durov’s Arrest Linked to Sweeping Criminal Investigation

    [ad_1]

    French prosecutors gave preliminary information in a press release on Monday about the investigation into Telegram CEO Pavel Durov, who was arrested suddenly on Saturday at Paris’ Le Bourget airport. Durov has not yet been charged with any crime, but officials said that he is being held as part of an investigation “against person unnamed” and can be held in police custody until Wednesday.

    The investigation began on July 8 and involves wide-ranging charges related to alleged money laundering, violations related to import and export of encryption tools, refusal to cooperate with law enforcement, and “complicity” in drug trafficking, possession and distribution of child pornography, and more.

    The investigation was initiated by “Section J3” cybercrime prosecutors and has involved collaboration with France’s Centre for the Fight against Cybercrime (C3N) and Anti-Fraud National Office (ONAF), according to the press release. “It is within this procedural framework in which Pavel Durov was questioned by the investigators,” Paris prosecutor Laure Beccuau wrote in the statement.

    Telegram did not respond to multiple requests for comment about the investigation but asserted in a statement posted to the company’s news channel on Sunday that Durov has “nothing to hide.”

    “Given the existence of several preliminary investigations in France concerning Telegram in relation to the protection of minors’ rights and in cooperation with other French investigation units—for instance, on cyber harassment—the arrest of Durov, does not seem to me like a highly exceptional move,” says Cannelle Lavite, a French lawyer who specializes in free-speech matters.

    Lavite notes that Durov is a French citizen who was arrested in French territory with an arrest warrant issued by French judges. She adds that the list of charges involved in the investigation is “extensive,” a wide net that she says is not entirely surprising in the context of “France’s ambiguous legislative arsenal” meant to balance content moderation and free speech.

    Durov is a controversial figure for his leadership of Telegram, in large part because he has not typically cooperated with calls to moderate the platform’s content. In some ways, this has positioned him as a free-speech defender against government censorship, but it has also made Telegram a haven for hate speech, criminal activity, and abuse. Additionally, the platform is often billed as a secure communication tool, but much of it is open and accessible by default.

    “Telegram is not primarily an encrypted messenger; most people use it almost as a social network, and they’re not using any of its features that have end-to-end encryption,” says John Scott-Railton, senior researcher at Citizen Lab. “The implication there is that Telegram has a wide range of abilities and access to potentially do content moderation and respond to lawful requests. This puts Pavel Durov very much in the center of all kinds of potential governmental pressure.”

    On top of all of this, many researchers have questioned whether Telegram’s end-to-end encryption is durable when users do elect to enable it.

    French president Emmanuel Macron said in a social media post on Monday that “France is deeply committed to freedom of expression and communication … The arrest of the president of Telegram on French soil took place as part of an ongoing judicial investigation. It is in no way a political decision.”

    News of Durov’s arrest is fueling concerns, though, that the move could threaten Telegram’s stability and undermine the platform. The case seems poised, too, to have implications in long-standing debates around the world about social media moderation, government influence, and use of privacy-preserving end-to-end encryption.

    Lavite says the case certainly invokes debates about “the balance between the right to encrypted communication and free speech on the one hand, and users’ protection—content moderation—on the other hand.” But she notes that there is a lot of information about the investigation that is unknown and “a lot of blurry zones still.”

    On Monday afternoon, Telegram seemed to be receiving a download boost from the situation, moving from 18th to 8th place in Apple’s US App Store apps ranking. Global iOS downloads were up by 4 percent, and in France the app was number one in the App Store social network category and number three overall.

    [ad_2]

    Lily Hay Newman

    Source link

  • The Arrest of Pavel Durov Is a Reminder That Telegram Is Not Encrypted

    The Arrest of Pavel Durov Is a Reminder That Telegram Is Not Encrypted

    [ad_1]

    French police arrested Pavel Durov, the outspoken and sperm-obsessed co-founder of Telegram, over the weekend on charges related to the spread of illicit material on the platform. As news spread of Durov’s arrest, outlets and pundits repeated a description of Telegram that isn’t true: they called it an encrypted messaging app.

    Reuters called Telegram an “encrypted application.” In Axios, Telegram is an “encrypted messaging app.” CNN quoted failed presidential candidate Robert F. Kennedy JR’s description of Durov as the CEO of the “encrypted, uncensored Telegram platform.”

    Telegram is a lot of things—a great place for open-source intelligence about war, a possible vector for child sex abuse material, and a hub for various scams and crimes—but it is absolutely not an encrypted chat app. Does Telegram provide an encrypted chat option? Yes, but it’s not on by default and turning it on isn’t easy.

    The distinction between encrypted and unencrypted apps is important. WhatsApp and Signal, for example, are end-to-end encrypted out of the box. They’re not completely secure but they do a pretty good job of keeping your information safe provided someone doesn’t get hold of your devices.

    With Telegram, all bets are off. Telegram is mostly about big group chats and channels where people share information with their fans. DMs are not, by default, end-to-end encrypted. Users can enable what Telegram calls “secret chats” but must do so for every single conversation they want encrypted. This is never on by default and can’t be activated for group DMs or channels.

    As John Hopkins security researcher Matthew Green pointed out in his blog on the subject, it’s also a pain in the ass to activate. “The button that activates Telegram’s encryption feature is not visible from the main conversation pane, or from the home screen. To find it in the iOS app, I had to click at least four times—once to access the user’s profile, once to make a hidden menu pop up showing me the options, and a final time to ‘confirm’ that I wanted to use encryption. And even after this, I was not able to actually have an encrypted conversation, since Secret Chats only works if your conversation partner happens to be online when you do this,” Green said.

    Again, you have to do this for every single chat you want kept hidden. With Signal and WhatsApp, it’s on by default for every conversation.

    So why does the world seem to think of Telegram as an encrypted app? Durov constantly says that it is and attacks the encryption of other platforms. In a long post on his Telegram channel (which isn’t encrypted) in May, Durov accused the U.S. government of having a hand in the creation of Signals’ encryption systems.

    “It looks almost as if big tech in the U.S. is not allowed to build its own encryption protocols that would be independent of government interference,” he said. “Telegram is the only massively popular messaging service that allows everyone to make sure that all of its apps indeed use the same open source code that is published on Github. For the past ten years, Telegram Secret Chats have remained the only popular method of communication that is verifiably private.”

    Durov has been bashing Signal and WhatsApp for years. He pursued a similar line of attack in 2017. “The encryption of Signal (=WhatsApp, FB) was funded by the U.S. Government,” he said in a tweet back then. “I predict a backdoor will be found there within 5 years from now.”

    Durov is right that Signal did get government grants early in development. It also got them from a lot of other places, including the Knight Foundation and the Freedom of Press Foundation. It’s ludicrous to claim, without proof, that a $3 million grant early in development equates to any kind of control or backdoor. It barely makes a dent in the $50 million it costs to run Signal annually now. Signal’s encryption algorithms are also open source and numerous cybersecurity experts have vouched for their authenticity.

    More than five years later Telegram still doesn’t have end-to-end encryption on by default, Signal is fixing its known security issues, and the French have arrested Durov on a host of charges related to the spread of illicit material on the platform.

    [ad_2]

    Matthew Gault

    Source link