ReportWire

Tag: Hacking

  • DOGE Put Everyone’s Social Security Data at Risk, Whistleblower Claims

    [ad_1]

    As students returned to school this week, WIRED spoke to a self-proclaimed leader of a violent online group known as “Purgatory” about a rash of swattings at universities across the US in recent days. The group claims to have ties to the loose cybercriminal network known as The Com, and the alleged Purgatory leader claimed responsibility for calling in hoax active-shooter alerts.

    Researchers from multiple organizations warned this week that cybercriminals are increasingly using generative AI tools to fuel ransomware attacks, including real situations where cybercriminals without technical expertise are using AI to develop the malware. And a popular, yet enigmatic, shortwave Russian radio station known as UVB-76 seems to have turned into a tool for Kremlin propaganda after decades of mystery and intrigue.

    But wait, there’s more! Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    Since it was first created, critics have warned that the young and inexperienced engineers in Elon Musk’s so-called Department of Government Efficiency (DOGE) were trampling over security and privacy rules in their seemingly reckless handling of US government data. Now a whistleblower claims that DOGE staff put one massive dataset at risk of hacking or leaking: a database containing troves of personal data about US residents, including virtually every American’s Social Security number.

    The complaint from Social Security Administration chief data officer Charles Borges, filed with the Office of the Special Counsel and reviewed by The New York Times, states that DOGE affiliates explicitly overruled security and privacy concerns to upload the SSA database to a cloud server that lacked sufficient security monitoring, “potentially violating multiple federal statutes” in its allegedly reckless handling of the data. Internal DOGE and SSA communications reviewed by the Times shows officials waving off concerns about the data’s lack of sanitization or anonymization before it was uploaded to the server, despite concerns from SSA officials about the lack of security of that data transfer.

    Borges didn’t allege that the data was actually breached or leaked, but Borges emphasized the vulnerability of the data and the immense cost if it were compromised. “Should bad actors gain access to this cloud environment, Americans may be susceptible to widespread identity theft, may lose vital health care and food benefits, and the government may be responsible for reissuing every American a new Social Security number at great cost,” Borges wrote.

    Nearly 10 months have passed since the revelation that China’s cyberespionage group known as Salt Typhoon had penetrated US telecoms, spying on Americans’ calls and texts. Now the FBI is warning that the net cast by those hackers may have been far broader than even previously thought, encompassing potential victims in 80 countries. The bureau’s top cyber official, Brett Leatherman, told The Wall Street Journal and The Washington Post that the hackers had shown interest in at least 600 companies, which the FBI notified, though it’s not clear how many of those possible targets the hackers breached or what level of access they achieved. “That global indiscriminate targeting really is something that is outside the norms of cyberspace operations,” Leatherman told the Journal. The FBI says that Salt Typhoon’s telecom hacking alone resulted in the spies gaining access to at least a million call records and targeted the calls and texts of more than a hundred Americans.

    Days after Donald Trump’s Alaska summit with Vladimir Putin, the White House moved to gut its own intelligence ranks. A senior CIA Russia analyst—29 years in service and slated for a coveted overseas post—was abruptly stripped of her clearance, The Washington Post reported. She was one of 37 officials forced out under an August 19 memo from Director of National Intelligence Tulsi Gabbard. The order listed no infractions. To colleagues, it looked like a loyalty purge. The firings have reportedly unsettled the CIA’s rank and file, sending a message that survival depends on hewing intelligence to fit the president’s views.

    On Monday, Gabbard unveiled what she calls “ODNI 2.0,” a restructuring that cuts more than 500 positions and shutters or folds whole offices she deems redundant. The Foreign Malign Influence Center and the Cyber Threat Intelligence Integration Center are being pared back, while the National Intelligence University will be absorbed into the Pentagon’s defense school. Gabbard says the plan will save $700 million a year and depoliticize intelligence. Critics noted, however, a fact sheet published by Gabbard on Monday itemized only a fraction of those savings, and tjeu warned that the overhaul could hollow out the very coordination ODNI was created post-9/11 to provide—discarding expertise and leaving the intelligence fragmented at a time of escalating threats.

    [ad_2]

    Andy Greenberg, Lily Hay Newman, Dell Cameron

    Source link

  • Exclusive: Crowdstrike CEO George Kurtz on $290 million acquisition of startup Onum and security in the AI age

    [ad_1]

    Cybersecurity is more than just software, says George Kurtz, CEO and cofounder of CrowdStrike. 

    “What we do at CrowdStrike is as old as time,” he told Fortune. “It’s good versus evil. It’s a human nature story embodied in technology.”

    It’s a battle that’s more urgent and complex than ever, as the rise of AI has ballooned the number of cyber threats and cyber criminals. This makes M&A—a longstanding feature of the cybersecurity sector—more high-stakes than ever. To be sure, some of the biggest deals of 2025 have been in cyber, from Palo Alto Networks’ $25 billion acquisition of CyberArk to Google’s proposed $32 billion acquisition of Wiz. 

    CrowdStrike, which went public in 2019, is also a longtime acquirer, and today announced its acquisition of data observability startup Onum for about $290 million. CrowdStrike today also announced its Q2 2025 earnings, beating expectations but offering a softer-than-expected revenue outlook sending its shares down roughly 4% in after hours trading. 

    Kurtz exclusively spoke to Fortune about the Onum deal and CrowdStrike’s M&A strategy going forward.

    “We like to get things at the right stage,” he said. “When you look at some of these other acquisitions, like CyberArk, you’re talking about a 20-year-old technology company with a lot of integration risk. These are big companies, and I’ve seen the movie before. When I was at McAfee, we acquired 21 companies, and never quite got them integrated… So, when it comes down to it, we’re maniacally focused on the customer experience, on making sure we’re disciplined enough to get this stuff integrated. We have a great track record of doing that.”

    Onum marks one of CrowdStrike’s early deals since last year’s much-publicized IT outage, which Kurtz says didn’t derail its M&A efforts, but offered a pause. In the aftermath, CrowdStrike set a high bar and refrained from closing any deals, while continuing to talk to companies, entrepreneurs, and VCs, keeping the M&A pipeline active, said Kurtz. The Onum deal ultimately came together in three months. The Madrid-based startup, which counts Dawn Capital and Insight Partners among its VC backers, was especially compelling to CrowdStrike for its real-time pipeline detection—the ability to analyze and detect threats or anomalies in data as it is being ingested into a company’s systems. 

    “If you think about the data we have, we started becoming the Reddit of security data for all these AI models,” said Kurtz. “The more data we get in, the larger the moat we actually have, and the greater the opportunity we have to solve bigger and broader problems from an AI perspective. That’s really driving our vision for AI-native SOC [security operations center]. It’s a natural extension.”

    In part, this is looking towards a future filled with AI agents. 

    “Our goal is to secure every AI agent,” said Kurtz. “Okay, what’s an AI agent? An AI agent is basically superhuman. It has access to data. It has an identity, though it might be a non-human identity. It has access to a workflow, and it has access to systems that are outside of your own boundaries… So, it has all of the exposure that we’re protecting against. 

    In a lot of ways, Onum is a classic CrowdStrike deal. Since 2017, CrowdStrike has acquired eight companies, including Humio in 2021 for $400 million and Flow Security in 2024 for a reported $200 million. 

    “There are some companies that are obviously richly-valued,” Kurtz said. “I think some of these companies don’t realize that they are starting to move into zombieland: You look at their last round valuation, and it might be great for them, but it’s expensive and it’s necessarily actionable for a lot of companies, even ours… So, you start to hit these big, multi-billion dollar valuations with not a lot of ARR, relatively speaking, and your pool of buyers dramatically shrinks. That’s why we like to catch them in the sweet spot of where we can add value, and that value accrues to CrowdStrike’s shareholders.”

    The goal, in the end, remains the same—security, and fighting the bad guys (who now have more weapons to play with). 

    “With gen AI, we’re democratizing destruction,” said Kurtz. “We’re taking a very sophisticated topic known by a relatively few number of people … and now you’re making all that expertise available to many more people. … The biggest thing is that you’re really compressing the timeframe that the good guys have to be able to deal with these problems, because the bad actors are moving so much faster now.” 

    What’s one thing Kurtz is sure of, looking to the future? 

    “We know there’s going to be a greater need for security tomorrow than there is today,” he said.  

    Introducing the 2025 Fortune Global 500, the definitive ranking of the biggest companies in the world. Explore this year’s list.

    [ad_2]

    Allie Garfinkle

    Source link

  • Sam Altman’s AI paradox: Warning of a bubble while raising trillions

    [ad_1]

    Welcome to Eye on AI! AI reporter Sharon Goldman here, filling in for Jeremy Kahn. In this edition… Sam Altman’s AI paradox…AI has quietly become a fixture of advertising…Silicon Valley’s AI deals are creating zombie startups…sources say Nvidia working on new AI chip for China that outperforms the H20.

    I was not invited to Sam Altman’s cozy dinner with reporters in San Francisco last week (whomp whomp), but maybe that’s for the best. I have trouble suppressing exasperated eye rolls when I hear peak Silicon Valley–ironic statements.

    I am not sure I could have controlled myself when the OpenAI CEO said that he believes AI could be in a “bubble,” with market conditions similar to the 1990s dotcom boom. Yes, he reportedly said, “investors as a whole are overexcited about AI.” 

    Yet, over the same meal, Altman also apparently said he expects OpenAI to spend trillions of dollars on its data center buildout in the “not very distant future,” adding that “you should expect a bunch of economists wringing their hands, saying, ‘This is so crazy, it’s so reckless,’ and we’ll just be like, ‘You know what? Let us do our thing.’”

    Ummm…what could be more frothy than pitching a multi-trillion-dollar expansion in an industry you’ve just called a bubble? Cue an eye roll reaching the top of my head. Sure, Altman may have been referring to smaller AI startups with sky-high valuations and little to no revenue, but still, the irony is rich. It’s particularly notable given the weak GPT-5 rollout earlier this month, which was supposed to mark a leap forward but instead left many disappointed with its routing system and lack of breakthrough progress.

    In addition, even as Altman speaks of bubbles, OpenAI itself is raising record sums. In early August, OpenAI secured a whopping $8.3 billion in new funding at a $300 billion valuation—part of its plan to raise $40 billion this year. That figure was five times oversubscribed. On top of that, employees are now poised to sell about $6 billion in shares to investors like SoftBank, Dragoneer, and Thrive, pushing the company’s valuation potentially up to $500 billion.

    OpenAI is hardly an outlier in its infrastructure binge. Tech giants are pouring unprecedented sums into AI buildouts in 2025: Microsoft alone plans to spend $80 billion on AI data centers this fiscal year, while Meta is projecting up to $72 billion in AI and infrastructure investments. And on the fundraising front, OpenAI has company too — rivals like Anthropic are chasing multibillion-dollar rounds of their own. 

    Wall Street’s biggest bulls, like Wedbush’s Dan Ives, seem unconcerned. Ives said Monday on CNBC’s “Closing Bell” that demand for AI infrastructure has grown 30% to 40% in the last months, calling the capex surge a validation moment for the sector. While he acknowledged “some froth” in parts of the market, he said the AI revolution with autonomous systems is only starting to play out and we are in the “second inning of a nine-inning game.” 

    And while a bubble implies an eventual bursting, and all the damage that results, the underlying phenomenon causing a bubble often has real value. The advent of the web in the ’90s was revolutionary; The bubble was a reflection of the massive opportunities opening up.

    Still, I’d be curious if anyone pressed Altman on the AI paradox—warning of a bubble while simultaneously bragging about OpenAI’s massive fundraising and spending. Perhaps over a glass of bubbly and a sugary sweet dessert? I’d also love to know if he fielded tougher questions on the other big issues looming over the company: its shift to a public benefit corporation (and what that means for the nonprofit), the current state of its Microsoft partnership, and whether its mission of “AGI to benefit all of humanity” still holds now that Altman himself has said AGI “is not a super-useful term.”

    In any case, I’m game for a follow-up chat with Altman & Co (call me!). I’ll bring the bubbly, pop the questions, and do my best to keep the eye rolls at bay.

    Also: In just a few weeks, I will be headed to Park City, Utah, to participate in our annual Brainstorm Tech conference at the Montage Deer Valley! Space is limited, so if you’re interested in joining me, register here. I highly recommend: There’s a fantastic lineup of speakers, including Ashley Kramer, chief revenue officer of OpenAI; John Furner, president and CEO of Walmart U.S.; Tony Xu, founder and CEO of DoorDash; and many, many more!

    With that, here’s more AI news.

    Sharon Goldman
    sharon.goldman@fortune.com
    @sharongoldman

    FORTUNE ON AI

    Wall Street isn’t worried about an AI bubble. Sam Altman is – by Beatrice Nolan

    MIT report: 95% of generative AI pilots at companies are failing – by Sheryl Estrada

    Silicon Valley talent keeps getting recycled, so this CEO uses a ‘moneyball’ approach for uncovering hidden AI geniuses in the new era – by Sydney Lake

    Waymo experimenting with generative AI, but exec says LiDAR and radar sensors important to self-driving safety ‘under all conditions’ – by Jessica Matthews

    AI IN THE NEWS

    More shakeups for Meta AI. The New York Times reported today that Meta is expected to announce that it will split its A.I. division — which is known as Meta Superintelligence Labs — into four groups. One will focus on AI research; one on  “superintelligence”; another on products; and one on infrastructure such as data centers. According to the article’s anonymous sources, the reorganization “is likely to be the final one for some time,” with moves “aimed at better organizing Meta so it can get to its goal of superintelligence and develop AI products more quickly to compete with others.” The news comes less than two months after CEO Mark Zuckerberg overhauled Meta’s entire AI organization, including bringing on Scale AI CEO Alexandr Wang as chief AI officer. 

    Madison Avenue is starting to love AI. According to the New York Times, artificial intelligence has quietly become a fixture of advertising. What felt novel when Coca-Cola released an AI-generated holiday ad last year is now mainstream: nearly 90% of big-budget marketers are already using—or planning to use—generative AI in video ads. From hyper-realistic backdrops to synthetic voice-overs, the technology is slashing costs and production times, opening TV spots to smaller businesses for the first time. Companies like Shuttlerock and ITV are helping brands replace weeks of work with hours, while tech giants like Meta and TikTok push their own AI ad tools. The shift raises ethical questions about displacing creatives and fooling viewers, but industry leaders say the genie is out of the bottle: AI isn’t just streamlining ad production—it’s reshaping the entire commercial playbook.

    Silicon Valley’s AI deals are creating zombie startups: ‘You hollowed out the organization.’ According to CNBC, Silicon Valley’s AI startup scene is being hollowed out as Big Tech sidesteps antitrust rules with a new playbook: licensing deals and talent raids that gut promising young companies. Windsurf, once in talks to be acquired by OpenAI, collapsed into turmoil after its founders bolted to Google in a $2.4 billion licensing pact; interim CEO Jeff Wang described tearful all-hands meetings as employees realized they’d been left with “nothing.” Similar moves have seen Meta sink $14.3 billion into Scale AI, Microsoft scoop up Inflection’s founders, and Amazon strip talent from Adept and Covariant—leaving behind so-called “zombie companies” with little future. While founders and top researchers cash out, investors and rank-and-file staff are often left stranded, sparking growing concern that these quasi-acquisitions not only skirt regulators but also threaten to choke off AI innovation at its source.

    Nvidia working on new AI chip for China that outperforms the H20, sources say. According to Reuters, Nvidia is developing a new China-specific AI chip, codenamed B30A, based on its cutting-edge Blackwell architecture. The chip, which could be delivered to Chinese clients for testing as soon as next month, would be more powerful than the current H20 but still fall below U.S. export thresholds—using a single-die design with about half the raw computing power of Nvidia’s flagship B300. The move comes after President Trump signaled possible approval for scaled-down chip sales to China, though regulatory approval is uncertain amid bipartisan concerns in Washington over giving Beijing access to advanced AI hardware. Nvidia argues that retaining Chinese buyers is crucial to prevent defections to domestic rivals like Huawei, even as Chinese regulators cast suspicion on the company’s products.

    EYE ON AI RESEARCH

    Study finds AI-led interviews improved outcomes. A new study looked at what happens when job interviews are run by AI voice agents instead of human recruiters. In a large experiment with 70,000 applicants, people were randomly assigned to be interviewed by a person, by an AI, or given the choice. Surprisingly, AI-led interviews actually improved outcomes: applicants interviewed by AI were 12% more likely to get job offers, 18% more likely to start jobs, and 17% more likely to still be employed after 30 days. Most applicants didn’t mind the change—78% even chose the AI when given the option, especially those with lower test scores. The AI also pulled out more useful information from candidates, leading recruiters to rate those interviews higher. Overall, the study shows that AI interviewers can perform just as well as, or even better than, human recruiters—without hurting applicant satisfaction.

    AI CALENDAR

    Sept. 8-10: Fortune Brainstorm Tech, Park City, Utah. Apply to attend here.

    Oct. 6-10: World AI Week, Amsterdam

    Oct. 21-22: TedAI San Francisco. Apply to attend here.

    Dec. 2-7: NeurIPS, San Diego

    Dec. 8-9: Fortune Brainstorm AI San Francisco. Apply to attend here.

    BRAIN FOOD

    Do AI chatbots need to be protected from harm? 

    AI lab Anthropic has introduced a new safety measure in its latest Claude models, which empowers the AI to terminate conversations in extreme cases of harmful or abusive interaction. The feature activates only after repeated redirections fail—typically for content requests involving sexual exploitation of minors or facilitation of large-scale violence. The company is notably framing this as a safeguard not principally for users, but for the model’s own “AI welfare,” reflecting an exploratory stance on the machine’s potential moral status.

    Unsurprisingly, the idea of granting AI moral status is contentious. Jonathan Birch, a philosophy professor at the London School of Economics, told The Guardian he welcomed Anthropic’s move for sparking a public debate about AI sentience—a topic he said many in the industry would rather suppress. At the same time, he warned that the decision risks misleading users into believing the chatbot is more real than it is.

    Others argue that focusing on AI welfare distracts from urgent human concerns. For example, while Claude is designed to end only the most extreme abusive conversations, it will not intervene in cases of imminent self-harm—even though a New York Times opinion piece yesterday urged such safeguards, written by a mother who discovered her daughter’s ChatGPT conversations only after her daughter’s suicide.

    [ad_2]

    Sharon Goldman

    Source link

  • Florida Man Accused of Hacking Disney World Menus, Changing Font to Wingdings

    Florida Man Accused of Hacking Disney World Menus, Changing Font to Wingdings

    [ad_1]

    With just days to go until the 2024 presidential election in the United States, WIRED reported on documents that revealed US government assessments about multiple components of election security and stability. First obtained by the national security transparency nonprofit Property of the People, one report distributed by the US Department of Homeland Security in October assessed that financially motivated cybercriminals and ideologically motivated hacktivists are more likely than state-backed hackers to attack US election infrastructure. Another government memo warned of the risk to the election of insider threats, noting that such internal malfeasance “could derail or jeopardize a fair and transparent election process.”

    With so much at stake in a hyper-polarized and combative climate, US elections have become increasingly militarized, with bulletproof glass, drones, defensive blockades, and snipers protecting election offices, and election officials bracing for the possibility of violent attacks. A WIRED investigation also revealed a successful CIA hack of Venezuela’s military payroll system that was part of a clandestine Trump administration effort to overthrow the country’s autocratic president, Nicolás Maduro.

    In other cybersecurity news, WIRED did a deep dive into the firewall vendor Sophos’ five-year turf war to try to remove Chinese hackers running espionage operations on some vulnerable devices—and keep them out. And researchers warn that a “critical” zero-click vulnerability in a default photo app on Synology network-attached storage devices could be exploited by hackers to steal data or infiltrate networks.

    As always, there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    A Disney employee who was fired from the company and still had access to its passwords allegedly hacked into the software used by Walt Disney World’s restaurants, according to reporting by 404 Media and Court Watch. A criminal complaint against Michael Scheuer claims he repeatedly accessed the third-party menu-creation system created for Disney and changed menus, including changing fonts to Windings—the font made up entirely of symbols.

    “The fonts were renamed by the threat actor to maintain the name of the original font, but the actual characters appeared as symbols,” the criminal complaint says. “As a result of this change, all of the menus within the database were unusable because the font changes propagated throughout the database.”

    The allegations aren’t limited to whimsical font vandalism, however. The federal complaint also details how Scheuer allegedly changed menu listings to say that foods with peanuts in them were safe for people with allergies, tried to log into Disney employees’ accounts, locked 14 employees out of their accounts by trying to log in with an automated script, and maintained a folder of personal information about employees and turned up at one person’s home. A lawyer representing Scheuer did not comment on the allegations.

    For the past few years, infostealers have become a popular tool of choice for hackers, from cybercriminals trying to make money to sophisticated nation state groups. The malware, which is often bundled into pirated software, uses web browsers to collect usernames and passwords, cookies, financial information, and other data you enter into your computer. This week, cops around the world took down the Redline infostealer, which has been used to grab more than 170 million pieces of information and has been linked to large-scale hacks. An almost identical infostealer called Meta was also disrupted. As part of Operation Magnus, US officials identified Russian national Maxim Rudometov as being behind the development of Redline. As TechCrunch reports, Rudometov was identified following a series of operational security errors, including reusing online handles and emails across social media apps and other websites. In its criminal complaint, the US Department of Justice pointed out Rudometov’s dating profile, which apparently has “liked” 89 other users and received no likes in return.

    In January 2018, it emerged that GPS data from running and cycling app Strava could expose secret military locations and the movements of people exercising around them. Officials warned that it was a clear security risk. Years later, many seemingly haven’t paid attention. French newspaper Le Monde has revealed in a series of stories that US Secret Service agents are leaking their data through the fitness app, allowing the movements of Joe Biden, Donald Trump, and Kamala Harris to be tracked. Security staff linked to French president Emmanuel Macron and Russian president Vladimir Putin are similarly exposing their movements. Those exposing their data used public profiles and often posted runs starting or finishing at the locations they were staying during official trips. Included in the leaks were bodyguards linked to Putin who were running near a palace the Russian leader has denied owning.

    Italian prosecutors placed four people under house arrest and revealed they are investigating at least 60 others after an intelligence firm in the country allegedly hacked government databases and gathered information on more than 800,000 people. Intelligence company Equalize allegedly gathered information about some of Italy’s most prominent politicians, entrepreneurs, and sports stars, Politico reported. It is alleged that the information accessed included bank transactions, police investigations, and more. The hacked information was reportedly sold or potentially used as part of extortion attempts, with those behind the scheme allegedly earning €3.1 million. The scandal, which has enraged Italian politicians, may also be wider than just its impact in Italy, with the latest reports suggesting Equalize counted Israeli intelligence and the Vatican as clients.

    [ad_2]

    Matt Burgess, Lily Hay Newman

    Source link

  • Cybercriminals Pose a Greater Threat of Disruptive US Election Hacks Than Russia or China

    Cybercriminals Pose a Greater Threat of Disruptive US Election Hacks Than Russia or China

    [ad_1]

    Russian, Chinese, and Iranian state-backed hackers have been active throughout the 2024 United States campaign season, compromising digital accounts associated with political campaigns, spreading disinformation, and probing election systems. But in a report from early October, the threat-sharing and coordination group known as the Election Infrastructure ISAC warned that cybercriminals like ransomware attackers pose a far greater risk of launching disruptive attacks than foreign espionage actors.

    While state-backed actors were emboldened following Russia’s meddling in the 2016 US presidential election, the report points out that they favor intelligence-gathering and influence operations rather than disruptive attacks, which would be viewed as direct hostility against the US government. Ideologically and financially motivated actors, on the other hand, generally aim to cause disruption with hacks like ransomware or DDoS attacks.

    The document was first obtained by the national security transparency nonprofit Property of the People and viewed by WIRED. The US Department of Homeland Security, which contributed to the report and distributed it, did not return WIRED’s requests for comment. The Center for Internet Security, which runs the Election Infrastructure ISAC, declined to comment.

    “Since the 2022 midterm elections, financially and ideologically motivated cyber criminals have targeted US state and local government entity networks that manage or support election processes,” the alert states. “In some cases, successful ransomware attacks and a distributed denial-of-service (DDoS) attack on such infrastructure delayed election-related operations in the affected state or locality but did not compromise the integrity of voting processes … Nation-state-affiliated cyber actors have not attempted to disrupt US elections infrastructure, despite reconnaissance and occasionally acquiring access to non-voting infrastructure.”

    According to DHS statistics highlighted in the report, 95 percent of “cyber threats to elections” were unsuccessful attempts by unknown actors. Two percent were unsuccessful attempts by known actors, and 3 percent were successful attempts “to gain access or cause disruption.” The report emphasizes that threat intelligence sharing and collaboration between local, state, and federal authorities help prevent breaches and mitigate the fallout of successful attacks.

    In general, government-backed hackers may stoke geopolitical tension by conducting particularly aggressive digital espionage, but their activity isn’t inherently escalatory so long as they are abiding by espionage norms. Criminal hackers are bound by no such restrictions, though they can call too much attention to themselves if their attacks are too disruptive and risk a law enforcement crackdown.

    [ad_2]

    Lily Hay Newman, Dell Cameron

    Source link

  • AP sources: Chinese hackers targeted phones of Trump, Vance, people associated with Harris campaign

    AP sources: Chinese hackers targeted phones of Trump, Vance, people associated with Harris campaign

    [ad_1]

    WASHINGTON — Chinese hackers engaged in a broader espionage operation targeted cellphones used by Republican presidential nominee Donald Trump, his running mate, JD Vance, and people associated with the Democratic campaign of Kamala Harris, people familiar with the matter said Friday.

    It was not immediately clear what data, if any, may have been accessed. U.S. officials are continuing to investigate, according to the people, who were not authorized to publicly discuss the ongoing inquiry and spoke on the condition of anonymity to The Associated Press.

    An FBI statement did not confirm the identities of any of the potential targets but said it was investigating “unauthorized access to commercial telecommunications infrastructure by actors affiliated with the People’s Republic of China.”

    “Agencies across the U.S. Government are collaborating to aggressively mitigate this threat and are coordinating with our industry partners to strengthen cyber defenses across the commercial communications sector,” the FBI said.

    U.S. officials believe the campaigns were among numerous targets of a larger cyberespionage operation launched by China, the people said. It was not immediately clear what information China may have hoped to glean, though Beijing has for years engaged in vast hacking campaigns aimed at collecting the private data of Americans and government workers, spying on technology and corporate secrets from major American companies and targeting U.S. infrastructure.

    News that high-profile political candidates and their campaigns were targeted comes as U.S. officials remain on high alert for foreign interference in the final stretch of the presidential campaign. Iranian hackers have been blamed for targeting Trump campaign officials and the Justice Department has exposed vast disinformation campaigns orchestrated by Russia, which is said to favor Trump over Harris.

    China, by contrast, is believed by U.S. intelligence officials to be taking a neutral stance in the race and is instead focused on down-ballot races, targeting candidates from both parties based on their stance on issues of key importance to Beijing, including support for Taiwan.

    The New York Times first reported that Trump and Vance had been targeted and said the campaign was advised of the development this week. Three people confirmed the news to the AP, including one who said that people associated with the Harris campaign were also targeted.

    A spokesperson for the Chinese embassy in Washington said Friday that they were not familiar with the specifics and could not comment, but contended that China is routinely victimized by cyberattacks and opposes the activity.

    “The presidential elections are the United States’ domestic affairs. China has no intention and will not interfere in the U.S. election. We hope that the U.S. side will not make accusations against China in the election,” the statement said.

    Trump campaign spokesman Steven Cheung did not offer any details about the Chinese operation but issued a statement accusing the Harris campaign of having emboldened foreign adversaries, including China and Iran. Trump did not respond to shouted questions about whether his phone had been hacked by China as he departed an event in Texas.

    The FBI has repeatedly warned over the last year about Chinese hacking operations, with Director Chris Wray telling Congress in January that investigators had disrupted a state-sponsored group known as Volt Typhoon. That operation disrupted a botnet of hundreds of U.S.-based small office and home routers owned by private citizens and companies. Their ultimate targets included water treatment plants, the electrical grid and transportation systems across the U.S, with Wray warning that Beijing was positioning itself to disrupt the daily lives of Americans if the United States and China ever go to war.

    Last month, Wray said that the FBI had interrupted a separate Chinese government campaign, called Typhoon Flax, that targeted universities, government agencies and other organizations and that installed malicious software on more than 200,000 consumer devices, including cameras, video recorders and home and office routers.

    The Wall Street Journal reported this month that Chinese hackers had burrowed inside the networks of U.S. broadband providers and had potentially accessed systems that law enforcement officials use for wiretapping requests.

    ____

    Michelle L. Price in New York and Jill Colvin in Austin, Texas contributed to this report.

    [ad_2]

    Source link

  • Chinese Hackers Target Trump Campaign via Verizon Breach

    Chinese Hackers Target Trump Campaign via Verizon Breach

    [ad_1]

    The Chinese spy operation adds to the growing sense of a melee of foreign digital interference in the election, which has already included Iranian hackers’ attempt to hack and leak emails from the Trump campaign—with limited success—and Russia-linked disinformation efforts across social media.

    Ahead of the full launch next week of Apple’s AI platform, Apple Intelligence, the company debuted tools this week for security researchers to evaluate its cloud infrastructure known as Private Cloud Compute. Apple has gone to great lengths to engineer a secure and private AI cloud platform, and this week’s release includes extensive detailed technical documentation of its security features as well as a research environment that is already available in the macOS Sequoia 15.1 beta release. The testing features allow researchers (or anyone) to download and evaluate the actual version of PCC software that Apple is running in the cloud at a given time. The company tells WIRED that the only modifications to the software relate to optimizing it to run in the virtual machine for the research environment. Apple also released the PCC source code and said that as part of its bug bounty program, vulnerabilities that researchers discover in PCC will be eligible for a maximum bounty payout of up to $1 million.

    Over the summer, Politico, The New York Times, and The Washington Post each revealed that they’d been approached by a source offering hacked Trump campaign emails—a source whom the US Justice Department says was working on behalf of the Iranian government. The news outlets all refused to publish or report on those stolen materials. Now it appears that Iran’s hackers did eventually find outlets outside the mainstream media that were willing to release those emails. American Muckrakers, a PAC run by a Democratic operative, did publish the documents after soliciting them in a public post on X, writing, “Send it to us and we’ll get it out.”

    American Muckrakers then published internal Trump campaign communications about North Carolina Republican gubernatorial candidate Mark Robinson and Florida Republican representative Anna Paulina Luna, as well as material that seemed to suggest a financial arrangement between Donald Trump and Robert F. Kennedy Jr., the third-party candidate who dropped out of the race and endorsed Trump. Independent journalist Ken Klippenstein also received and published some of the hacked material, including a research profile on Trump running mate and US senator JD Vance that the campaign assembled when assessing him for the role. Klippenstein subsequently received a visit from the FBI, he’s said, warning him that the documents were shared as part of a foreign influence campaign. Klippenstein has defended his position, arguing that the media should not serve as “gatekeeper of what the public should know.”

    As Russia has both waged war and cyberwar against Ukraine, it’s also carried out a vast campaign of hacking against another neighbor to the west with whom it’s long had a fraught relationship: Georgia. Bloomberg this week revealed ahead of the Georgian election how Russia systematically penetrated the smaller country’s infrastructure and government in a yearslong series of digital intrusion operations. From 2017 to 2020, for instance, Russia’s military intelligence agency, the GRU, hacked Georgia’s Central Election Commission (just as it did in Ukraine in 2014), multiple media organizations, and IT systems at the country’s national railway company—all in addition to the attack on Georgian TV stations that the NSA pinned on the GRU’s Sandworm unit in 2020. Meanwhile, hackers known as Turla, working for the Kremlin’s KGB successor, the FSB, broke into Georgia’s Foreign Ministry and stole gigabytes of officials’ emails over months. According to Bloomberg, Russia’s hacking efforts weren’t limited to espionage but also appeared to include preparing for disruption of Georgian infrastructure like the electric grid and oil companies in the event of an escalating conflict.

    For years, cybersecurity professionals have argued about what constitutes a cyberattack. An intrusion designed to destroy data, cause disruption, or sabotage infrastructure? Yes, that’s a cyberattack. A hacker breach to steal data? No. A hack-and-leak operation or an espionage mission with a disruptive clean-up phase? Probably not, but there’s room for debate. The Jerusalem Post this week, however, achieved perhaps the clearest-cut example of calling something a cyberattack—in a headline no less—that is very clearly not: disinformation on social media. The so-called “Hezbollah cyberattack” that the news outlet reported was a collection of photos of Israeli hospitals posted by “hackers” identifying as Hezbollah supporters that suggested weapons and cash were stored underneath them and that they should be attacked. The posts seemingly came in response to the Israeli Defense Forces’ repeating similar claims about hospitals in Gaza that the IDF has bombed, as well as another more recently in Lebanon’s capital city of Beirut.

    “These are NOT CYBERATTACKS,” security researcher Lukasz Olejnik, the author of the books The Philosophy of Cybersecurity and Propaganda, wrote next to a screenshot of the Jerusalem Post headline on X. “Posting images to social media is not hacking. Such a bad take.”

    [ad_2]

    Lily Hay Newman, Andy Greenberg

    Source link

  • Google Chrome’s uBlock Origin Purge Has Begun

    Google Chrome’s uBlock Origin Purge Has Begun

    [ad_1]

    And that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    If you use uBlock Origin’s Chrome extension to filter out online ads, expect to get mildly annoyed in the near future. Google has begun implementing new Chrome extension standards, called Manifest V3, that will disable the legacy version of uBlock Origin’s extension that most users likely have installed. And while you might be thinking, “Google is a silverback gorilla of online advertising, of course they’re finally forcing me to see ads!” there is some good news. A new version of the ad-filtering extension that meets the Manifest V3 standards, uBlock Origin Lite, is now available. Then again, it won’t block as much as the previous iteration of uBlock. Still, as a Google spokesperson told The Verge, you have options: “The top content filtering extensions all have Manifest V3 versions available — with options for users of AdBlock, Adblock Plus, uBlock Origin and AdGuard.” Either way, you’ll need to install a new extension soon.

    US authorities announced charges this week against a 25-year-old Alabama man accused of hacking the Security and Exchange Commission’s X account. Prosecutors claim Eric Council Jr. obtained personal information and the materials for a fake ID of a person who controlled the @SECGov account from unidentified coconspirators. Council allegedly used the fake ID to carry out a SIM-swapping attack, duping AT&T retail store staff into giving him a new SIM card, which he ultimately used to take control of the victim’s phone account. The coconspirators used that to gain access to the SEC’s X account, where they posted a fake announcement about Bitcoin’s regulatory status, which was followed by a price jump of $1,000 per bitcoin. Council stands charged of conspiracy to commit aggravated identity theft and access device fraud.

    The grocery store chain Kroger has never used facial-recognition technology broadly in its stores and has no current plans to, a spokesperson told Fast Company this week. The company has been facing a firestorm over its use of electronic shelving labels over concerns that ESLs could be used to impose surge pricing on popular items, and fears that the devices could also be deployed with facial recognition. The company did a single-store facial-recognition pilot of a technology called EDGE in 2019, but it did not move forward with the service. US lawmakers including Rashida Tlaib, Elizabeth Warren, and Robert Casey have publicly raised concerns about Kroger’s use of ESLs.

    Microsoft told customers that it failed to capture more than two weeks of security logs from certain cloud services in September, including Microsoft Entra, Sentinel, Defender for Cloud, and Purview. News of the lost logs was first reported by Business Insider. The company said in the notification that “a bug in one of Microsoft’s internal monitoring agents resulted in a malfunction in some of the agents when uploading log data to our internal logging platform.” The blank extends from September 2 to September 19. A Microsoft executive confirmed to TechCrunch that the incident was caused by an “operational bug within our internal monitoring agent.”

    System activity logs are crucial for all sorts of operations and are particularly used for security monitoring and investigations, because they can expose breaches and malicious activity. After Russian hackers breached US government networks through SolarWinds software in 2020, many agencies couldn’t detect the activity in their Microsoft Azure cloud services because they weren’t paying for Microsoft’s premium tier features, so they didn’t have adequate network activity logs. Lawmakers were outraged about the up-charge, and the Biden administration worked for more than two years to get Microsoft to make the logging services free. The company ultimately announced the change in July 2023.

    [ad_2]

    Lily Hay Newman, Andrew Couts

    Source link

  • Hacker Charged With Seeking to Kill Using Cyberattacks on Hospitals

    Hacker Charged With Seeking to Kill Using Cyberattacks on Hospitals

    [ad_1]

    In December of 2023, for instance, Anonymous Sudan took OpenAI’s ChatGPT offline with a sustained series of DDoS attacks in response to the company’s executive Tal Broda vocally supporting the Israel Defense Forces’ missile attacks in Gaza. “More! No mercy! IDF don’t stop!” Broda had written on X over a photo of a devastated urban landscape in Gaza, and in another post denied the existence of Palestine.

    “We will continue targeting ChatGPT until the genocide supporter, Tal Broda, is fired and ChatGPT stops having dehumanizing views of Palestinians,” Anonymous Sudan responded in a Telegram post explaining its attacks on OpenAI.

    Still, Anonymous Sudan’s true goals haven’t always seemed entirely ideological, Akamai’s Seaman says. The group has also offered to sell access to its DDoS infrastructure to other hackers: Telegram posts from the group as recently as March offered the use of its DDoS service, known as Godzilla or Skynet, for $2,500 a month. That suggests that even its attacks that appeared to be politically motivated may have been intended, at least in part, as marketing for its moneymaking side, Seaman argues.

    “They seem to have thought, ‘We can get involved, really put a hurting on people, and market this service at the same time,’” Seaman says. He notes that, in the group’s anti-Israel, pro-Palestine focus following the October 7 attacks, “there’s definitely an ideological thread in there. But the way it weaved through the different victims is something that maybe only the perpetrators of the attack fully understand.”

    At times, Anonymous Sudan also hit Ukrainian targets, seemingly partnering with pro-Russian hacker groups like Killnet. That led some in the cybersecurity community to suspect that Anonymous Sudan was, in fact, a Russia-linked operation using its Sudanese identity as a front, given Russia’s history of using hacktivism as false flag. The charges against Ahmed and Alaa Omer suggest that the group was, instead, authentically Sudanese in origin. But aside from its name, the group doesn’t appear to have any clear ties to the original Anonymous hacker collective, which has been largely inactive for the last decade.

    Aside from its targeting and politics, the group has distinguished itself through a relatively novel and effective technical approach, Akamai’s Seaman says: Its DDoS service was built by gaining access to hundreds or possibly even thousands of virtual private servers—often-powerful machines offered by cloud services companies—by renting them with fraudulent credentials. It then used those machines to launch so-called layer 7 attacks, overwhelming web servers with requests for websites, rather than the lower-level floods of raw internet data requests that DDoS hackers have tended to use in the past. Anonymous Sudan and the customers of its DDoS services would then target victims with vast numbers of those layer 7 requests in parallel, sometimes using techniques called “multiplexing” or “pipelining” to simultaneously create multiple bandwidth demands on servers until they dropped offline.

    [ad_2]

    Andy Greenberg

    Source link

  • Pig Butchering Scams Are Going High Tech

    Pig Butchering Scams Are Going High Tech

    [ad_1]

    As digital scamming explodes in Southeast Asia, including so called “pig butchering” investment scams, the United Nations Office on Drugs and Crime (UNODC) issued a comprehensive report this week with a dire warning about the rapid growth of this criminal ecosystem. Many digital scams have traditionally relied on social engineering, or tricking victims into giving away their money willingly, rather than leaning on malware or other highly technical methods. But researchers have increasingly sounded the alarm that scammers are incorporating generative AI content and deepfakes to expand the scale and effectiveness of their operations. And the UN report offers the clearest evidence yet that these high tech tools are turning an already urgent situation into a crisis.

    In addition to buying written scripts to use with potential victims or relying on templates for malicious websites, attackers have increasingly been leaning on generative AI platforms to create communication content in multiple languages and deepfake generators that can create photos or even video of nonexistent people to show victims and enhance verisimilitude. Scammers have also been expanding their use of tools that can drain a victim’s cryptocurrency wallets, have been manipulating transaction records to trick targets into sending cryptocurrency to the wrong places, and are compromising smart contracts to steal cryptocurrency. And in some cases, they’ve been purchasing Elon Musk’s Starlink satellite internet systems to help power their efforts.

    “Agile criminal networks are integrating these new technologies faster than anticipated, driven by new online marketplaces and service providers which have supercharged the illicit service economy,” John Wojcik, a UNODC regional analyst, tells WIRED. “These developments have not only expanded the scope and efficiency of cyber-enabled fraud and cybercrime, but they have also lowered the barriers to entry for criminal networks that previously lacked the technical skills to exploit more sophisticated and profitable methods.”

    For years, China-linked criminals have trafficked people into gigantic compounds in Southeast Asia, where they are often forced to run scams, held against their will, and beaten if they refuse instructions. Around 200,000 people, from at least 60 countries, have been trafficked to compounds largely in Myanmar, Cambodia, and Laos over the last five years. However, as WIRED reporting has shown, these operations are spreading globally—with scamming infrastructure emerging in the Middle East, Eastern Europe, Latin America, and West Africa.

    Most prominently, these organized crime operations have run pig butchering scams, where they build intimate relationships with victims before introducing an “investment opportunity” and asking for money. Criminal organizations may have conned people out of around $75 billion through pig butchering scams. Aside from pig butchering, according to the UN report, criminals across Southeast Asia are also running job scams, law enforcement impersonation, asset recovery scams, virtual kidnappings, sextortion, loan scams, business email compromise, and other illicit schemes. Criminal networks in the region earned up to $37 billion last year, UN officials estimate. Perhaps unsurprisingly, all of this revenue is allowing scammers to expand their operations and diversify, incorporating new infrastructure and technology into their systems in the hope of making them more efficient and brutally effective.

    For example, scammers are often constrained by their language skills and ability to keep up conversations with potentially hundreds of victims at a time in numerous languages and dialects. However, generative AI developments within the last two years—including the launch of writing tools such as ChatGPT—are making it easier for criminals to break down language barriers and create the content needed for scamming.

    [ad_2]

    Matt Burgess, Lily Hay Newman

    Source link

  • Internet Archive Breach Exposes 31 Million Users

    Internet Archive Breach Exposes 31 Million Users

    [ad_1]

    An illicit JavaScript popup on the Internet Archive proclaimed on Wednesday afternoon that the site had suffered a major data breach. Hours later, the organization confirmed the incident.

    Longtime security researcher Troy Hunt, who runs the data breach notification website Have I Been Pwned (HIBP), also confirmed that the breach is legitimate. He said that it occurred in September and the stolen trove contains 31 million unique email addresses along with usernames, bcrypt password hashes, and other system data. Bleeping Computer, which first reported the breach, also confirmed the validity of the data.

    The Internet Archive did not yet return multiple requests for comment from WIRED.

    “Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach?” the attackers wrote in Wednesday’s Internet Archive popup message. “It just happened. See 31 million of you on HIBP!”

    In addition to the breach and site defacement, the Internet Archive has been grappling with a wave of distributed denial-of-service attacks that have intermittently brought down its services.

    Internet Archive founder Brewster Kahle provided a public update on Wednesday evening in a post on the social network X. “What we know: DDOS attack–fended off for now; defacement of our website via JS library; breach of usernames/email/salted-encrypted passwords. What we’ve done: Disabled the JS library, scrubbing systems, upgrading security. Will share more as we know it.” “Scrubbing systems” refer to services that offer DDoS attack protection by filtering malicious junk traffic so it can’t deluge and disrupt a website.

    The Internet Archive has faced aggressive DDoS attacks numerous times in the past, including in late May. As Kahle wrote on Wednesday: “Yesterday’s DDOS attack on @internetarchive repeated today. We are working to bring http://archive.org back online.” The hacktivist group known as “BlackMeta” claimed responsibility for this week’s DDoS attacks and said it plans to carry out more against the Internet Archive. Still, the perpetrator of the data breach is not yet known.

    The Internet Archive has faced battles on many fronts in recent months. In addition to repeated DDoS attacks, the organization is also facing mounting legal challenges. It recently lost an appeal in Hachette v. Internet Archive, a lawsuit brought by book publishers, which argued that its digital lending library violated copyright law. Now, it’s facing an existential threat in the form of another copyright lawsuit, this one from music labels, which may result in damages upwards of $621 million if the court rules against the archive.

    HIBP’s Hunt says that he first received the stolen Internet Archive data on September 30, reviewed it on October 5, and warned the organization about it on October 6. He says the group confirmed the breach to him the next day and that he planned to load the data into HIBP and notify its subscribers about the breach on Wednesday. “They get defaced and DDoS’d, right as the data is loading into HIBP,” Hunt wrote. “The timing on the last point seems to be entirely coincidental.”

    Hunt added, too, that while he encouraged the group to publicly disclose the data breach itself before the HIBP notifications went out, the extenuating circumstances may explain the delay.

    “Obviously I would have liked to see that disclosure much earlier, but understanding how under attack they are, I think everyone should cut them some slack,” Hunt wrote. “They’re a non-profit doing great work and providing a service that so many of us rely heavily on.”

    [ad_2]

    Lily Hay Newman, Kate Knibbs

    Source link

  • China-linked security breach targeted U.S. wiretap systems, WSJ reports

    China-linked security breach targeted U.S. wiretap systems, WSJ reports

    [ad_1]

    People observe the scenery near Chinese national flags displayed for National Day celebrations on October 3, 2024 in Chongqing, China. National Day Golden Week is a holiday in China commemorates the founding of the People’s Republic of China in 1949. 

    Cheng Xin | Getty Images

    U.S. broadband providers had their networks breached in a cyberattack tied to the Chinese government that targeted wiretap requests, the Wall Street Journal reported on Saturday.

    The attack may have allowed China to gain information on the American federal government’s court-authorized network wiretapping requests, the newspaper found.

    It’s possible the hackers had access for months or longer to networks the U.S. uses to make lawful requests for communications data, the WSJ wrote, citing people familiar with the matter.

    China denies allegations from Western governments and technology companies that it uses hackers to access government information.

    Government officials have been concerned these cyberattacks could be used to disrupt U.S. systems in the event of a conflict between China and the U.S., the newspaper said.

    The cyber breach, carried out by the Chinese hacking group known as Salt Typhoon, poses serious national security risks, the WSJ reported.

    The F.B.I. declined to respond to CNBC’s request for comment.

    Read The Wall Street Journal’s article here.

    [ad_2]

    Source link

  • Stealthy Malware Has Infected Thousands of Linux Systems for Years

    Stealthy Malware Has Infected Thousands of Linux Systems for Years

    [ad_1]

    Other discussions include: Reddit, Stack Overflow (Spanish), forobeta (Spanish), brainycp (Russian), natnetwork (Indonesian), Proxmox (Deutsch), Camel2243 (Chinese), svrforum (Korean), exabytes, virtualmin, serverfault and many others.

    After exploiting a vulnerability or misconfiguration, the exploit code downloads the main payload from a server, which, in most cases, has been hacked by the attacker and converted into a channel for distributing the malware anonymously. An attack that targeted the researchers’ honeypot named the payload httpd. Once executed, the file copies itself from memory to a new location in the /temp directory, runs it, and then terminates the original process and deletes the downloaded binary.

    Once moved to the /tmp directory, the file executes under a different name, which mimics the name of a known Linux process. The file hosted on the honeypot was named sh. From there, the file establishes a local command-and-control process and attempts to gain root system rights by exploiting CVE-2021-4043, a privilege-escalation vulnerability that was patched in 2021 in Gpac, a widely used open source multimedia framework.

    The malware goes on to copy itself from memory to a handful of other disk locations, once again using names that appear as routine system files. The malware then drops a rootkit, a host of popular Linux utilities that have been modified to serve as rootkits, and the miner. In some cases, the malware also installs software for “proxy-jacking,” the term for surreptitiously routing traffic through the infected machine so the true origin of the data isn’t revealed.

    The researchers continued:

    As part of its command-and-control operation, the malware opens a Unix socket, creates two directories under the /tmp directory, and stores data there that influences its operation. This data includes host events, locations of the copies of itself, process names, communication logs, tokens, and additional log information. Additionally, the malware uses environment variables to store data that further affects its execution and behavior.

    All the binaries are packed, stripped, and encrypted, indicating significant efforts to bypass defense mechanisms and hinder reverse engineering attempts. The malware also uses advanced evasion techniques, such as suspending its activity when it detects a new user in the btmp or utmp files and terminating any competing malware to maintain control over the infected system.

    By extrapolating data such as the number of Linux servers connected to the internet across various services and applications, as tracked by services such as Shodan and Censys, the researchers estimate that the number of machines infected by Perfctl is measured in the thousands. They say that the pool of vulnerable machines—meaning those that have yet to install the patch for CVE-2023-33426 or contain a vulnerable misconfiguration—is in the millions. The researchers have yet to measure the amount of cryptocurrency the malicious miners have generated.

    People who want to determine if their device has been targeted or infected by Perfctl should look for indicators of compromise included in Thursday’s post. They should also be on the lookout for unusual spikes in CPU usage or sudden system slowdowns, particularly if they occur during idle times. Thursday’s report also provides steps for preventing infections in the first place.

    This story originally appeared on Ars Technica.

    [ad_2]

    Dan Goodin, Ars Technica

    Source link

  • Alleged plots against US campaign are only the latest examples of Iran targeting adversaries

    Alleged plots against US campaign are only the latest examples of Iran targeting adversaries

    [ad_1]

    DUBAI, United Arab Emirates — Iran has emerged as a twofold concern for the United States as it nears the end of the presidential campaign.

    Prosecutors allege Tehran tried to hack figures associated with the election, stealing information from former President Donald Trump’s campaign. And U.S. officials have accused it of plotting to kill Trump and other ex-officials.

    For Iran, assassination plots and hacking aren’t new strategies.

    Iran saw the value and the danger of hacking in the early 2000s, when the Stuxnet virus, believed to have been deployed by Israel and the U.S., tried to damage Iran’s nuclear program. Since then, hackers attributed to state-linked operations have targeted the Trump campaign, Iranian expatriates and government officials at home.

    Its history of assassinations goes back further. After the 1979 Islamic Revolution, Iran killed or abducted perceived enemies living abroad.

    A look at Iran’s history of targeting opponents:

    For many, Iran’s behavior can be traced to the emergence of the Stuxnet computer virus. Released in the 2000s, Stuxnet wormed its way into control units for uranium-enriching centrifuges at Iran’s Natanz nuclear facility, causing them to speed up, ultimately destroying themselves.

    Iranian scientists initially believed mechanical errors caused the damage. Ultimately though, Iran removed the affected equipment and sought its own way of striking enemies online.

    “Iran had an excellent teacher in the emerging art of cyberwarfare,” wryly noted a 2020 report from the King Faisal Center for Research and Islamic Studies in Saudi Arabia.

    That was acknowledged by the National Security Agency in a document leaked by former NSA contractor Edward Snowden in 2015 to The Intercept, which examined a cyberattack that destroyed hard drives at Saudi Arabia’s state oil company. Iran has been suspected of carrying out that attack, called Shamoon, in 2012 and again in 2017.

    “Iran, having been a victim of a similar cyberattack against its own oil industry in April 2012, has demonstrated a clear ability to learn from the capabilities and actions of others,” the document said.

    There also were domestic considerations. In 2009, the disputed reelection of hard-line President Mahmoud Ahmadinejad sparked the Green Movement protests. Twitter, one source of news from the demonstrations, found its website defaced by the self-described “Iranian Cyber Army.” There’s been suspicion that the Revolutionary Guard, a major power base within Iran’s theocracy, oversaw the “Cyber Army” and other hackers.

    Meanwhile, Iran itself has been hacked repeatedly in embarrassing incidents. They include the mass shutdown of gas stations across Iran, as well as surveillance cameras at Tehran’s notorious Evin Prison and even state television broadcasts.

    Iranian hacking attacks, given their low cost and high reward, likely will continue as Iran faces a tense international environment surrounding Israel’s conflicts with Hamas and Hezbollah, Iran’s enrichment of uranium to near weapons-grade levels and the prospect of Trump becoming president again.

    The growth of 3G and 4G mobile internet services in Iran also made it easier for the public — and potential hackers — to access the internet. Iran has over 50 major universities with computer science or information technology programs. At least three of Iran’s top schools are thought to be affiliated with Iran’s Defense Ministry and the Guard, providing potential hackers for security forces.

    Iranian hacking attempts on U.S. targets have included banks and even a small dam near New York City — attacks American prosecutors linked to the Guard.

    While Russia is seen as the biggest foreign threat to U.S. elections, officials have been concerned about Iran. Its hacking attempts in the presidential campaign have relied on phishing — sending many misleading emails in hopes that some recipients will inadvertently provide access to sensitive information.

    Amin Sabeti, a digital security expert who focuses on Iran, said the tactic works.

    “It’s scalable, it’s cheap and you don’t need a skill set because you just put, I don’t know, five crazy people who are hard line in an office in Tehran, then send tens of thousands of emails. If they get 10 of them, it’s enough,” he said.

    For Iran, hacks targeting the U.S. offer the prospect of causing chaos, undermining Trump’s campaign and obtaining secret information.

    “I’ve lost count of how many attempts have been made on my emails and social media since it’s been going on for over a decade,” said Holly Dagres, a nonresident senior fellow at the Atlantic Council who once had her email briefly hacked by Iran. “The Iranians aren’t targeting me because I have useful information swimming in my inbox or direct messages. Rather, they hope to use my name and think tank affiliation to target others and eventually make it up the chain to high-ranking U.S. government officials who would have useful information and intelligence related to Iran.”

    Iran has vowed to exact revenge against Trump and others in his former administration over the 2020 drone strike that killed the prominent Revolutionary Guard Gen. Qassem Soleimani in Baghdad.

    In July, authorities said they learned of an Iranian threat against Trump and boosted security. Iran has not been linked to the assassination attempts against Trump in Florida and Pennsylvania. A Pakistani man who spent time in Iran was recently charged by federal prosecutors for allegedly plotting to carry out assassinations in the U.S., including potentially of Trump.

    Officials take Iran’s threat seriously given its history of targeting adversaries.

    After the 1979 Islamic Revolution, its leader Ayatollah Ruhollah Khomeini signaled how Iran would target perceived enemies by saying, “Islam grew with blood.”

    “The great prophet of Islam, he had the Quran in one hand, and a sword in the other hand — a sword to suppress traitors,” Khomeini said.

    Even before creating a network of allied militias in the Mideast, Iran is suspected of targeting opponents abroad, beginning with members of Shah Mohammad Reza Pahlavi’s former government. The attention shifted to perceived opponents of the theocracy, both in the country with the mass executions of 1988 and abroad.

    Outside of Iran, the so-called “chain murders” targeted activists, journalists and other critics. One prominent incident linked to Iran was a shooting at a restaurant in Germany that killed three Iranian-Kurdish figures and a translator. In 1997, a German court implicated Iran’s top leaders in the shooting, sparking most European Union nations to withdraw their ambassadors.

    Iran’s targeted killings slowed after that, but didn’t stop. U.S. prosecutors link Iran’s Revolutionary Guard to a 2011 plot to kill the Saudi ambassador to Washington. Meanwhile, a suspected Israeli campaign of assassinations targeted scientists in Iran’s nuclear program.

    In 2015, Iran signed a nuclear deal that saw it greatly reduce its enrichment in exchange for the lifting of sanctions. Two years later, Trump was elected pledging to unilaterally withdraw America from the accord. As businesses backed away from Iran, Tehran renewed a campaign of targeting opponents abroad, but this time capturing them and bringing them to Iran for trial.

    Belgium arrested an Iranian diplomat, Assadollah Assadi, in 2018 and ultimately convicted him of masterminding a thwarted bomb attack against an exiled Iranian opposition group. Iran also increasingly has turned to criminal gangs for some attempts, such as what U.S. prosecutors have described as plots to kill or kidnap opposition activist Masih Alinejad.

    Among those targeted after Soleimani’s death was former U.S. national security adviser John Bolton. The U.S. has offered a reward of up to $20 million for information leading to the capture or conviction of a Revolutionary Guard member it said arranged to kill Bolton for $300,000.

    An FBI agent quoted Guard Gen. Esmail Ghaani as saying in 2022 in a court filing, “Wherever is necessary we take revenge against Americans by the help of people on their side and within their own homes without our presence.”

    [ad_2]

    Source link

  • The US and Microsoft disrupt a Russian hacking group targeting American officials and nonprofits

    The US and Microsoft disrupt a Russian hacking group targeting American officials and nonprofits

    [ad_1]

    WASHINGTON — A hacking group tied to Russian intelligence tried to worm its way into the systems of dozens of Western think tanks, journalists and former military and intelligence officials, Microsoft and U.S. authorities said Thursday.

    The group, known as Star Blizzard to cyberespionage experts, targeted its victims with emails that appeared to come from a trusted source — a tactic known as spear phishing. In fact, the emails sought access to the victims’ internal systems, as a way to steal information and disrupt their activities.

    Star Blizzard’s actions were persistent and sophisticated, according to Microsoft, and the group often did detailed research on its targets before launching an attack. Star Blizzard also went after civil society groups, U.S. companies, American military contractors and the Department of Energy, which oversees many nuclear programs, the company said.

    On Thursday, a U.S. court unsealed documents authorizing Microsoft and the Department of Justice to seize more than 100 website domain names associated with Star Blizzard. That action came after a lawsuit was filed against the network by Microsoft and the NGO-Information Sharing and Analysis Center, a nonprofit tech organization that investigated Star Blizzard.

    Authorities haven’t gone into details about Star Blizzard’s effectiveness but said they expect Russia to keep deploying hacking and cyberattacks against the U.S. and its allies.

    “The Russian government ran this scheme to steal Americans’ sensitive information, using seemingly legitimate email accounts to trick victims into revealing account credentials,” Deputy Attorney General Lisa Monaco said in announcing the U.S. actions against Star Blizzard. “With the continued support of our private sector partners, we will be relentless in exposing Russian actors and cybercriminals and depriving them of the tools of their illicit trade.”

    Star Blizzard has been linked to Russia’s Federal Security Service, or FSB. Last year, British authorities accused the group of mounting a yearslong cyberespionage campaign against U.K. lawmakers. Microsoft said it has been tracking the group’s activities since 2017.

    Microsoft said it observed Star Blizzard attempt dozens of hacking efforts targeting 30 different groups since January 2023. The tech giant’s cybersecurity experts say Star Blizzard has proven to be especially elusive.

    “Star Blizzard’s ability to adapt and obfuscate its identity presents a continuing challenge for cybersecurity professionals,” the company wrote in a report on its findings.

    U.S. authorities charged two Russian men last year in connection with Star Blizzard’s past actions. Both are believed to be in Russia.

    Along with American targets, Star Blizzard went after people and groups throughout Europe and in other NATO countries. Many had supported Ukraine following Russia’s invasion.

    A message left with the Russian Embassy in Washington was not immediately returned Thursday.

    [ad_2]

    Source link

  • Hacking Generative AI for Fun and Profit

    Hacking Generative AI for Fun and Profit

    [ad_1]

    You hardly need ChatGPT to generate a list of reasons why generative artificial intelligence is often less than awesome. The way algorithms are fed creative work often without permission, harbor nasty biases, and require huge amounts of energy and water for training are all serious issues.

    Putting all that aside for a moment, though, it is remarkable how powerful generative AI can be for prototyping potentially useful new tools.

    I got to witness this firsthand by visiting Sundai Club, a generative AI hackathon that takes place one Sunday each month near the MIT campus. A few months ago, the group kindly agreed to let me sit in and chose to spend that session exploring tools that might be useful to journalists. The club is backed by a Cambridge nonprofit called Æthos that promotes socially responsible use of AI.

    The Sundai Club crew includes students from MIT and Harvard, a few professional developers and product managers, and even one person who works for the military. Each event starts with a brainstorm of possible projects that the group then whittles down to a final option that they actually try to build.

    Notable pitches from the journalism hackathon included using multimodal language models to track political posts on TikTok, to auto-generate freedom of information requests and appeals, or to summarize video clips of local court hearings to help with local news coverage.

    In the end, the group decided to build a tool that would help reporters covering AI identify potentially interesting papers posted to the Arxiv, a popular server for research paper preprints. It’s likely my presence swayed them here, given that I mentioned at the meeting that scouring the Arxiv for interesting research was a high priority for me.

    After coming up with a goal, coders on the team were able to create a word embedding—a mathematical representation of words and their meanings—of Arxiv AI papers using the OpenAI API. This made it possible to analyze the data to find papers relevant to a particular term, and to explore relationships between different areas of research.

    Using another word embedding of Reddit threads as well as a Google News search, the coders created a visualization that shows research papers along with Reddit discussions and relevant news reports.

    The resulting prototype, called AI News Hound, is rough-and-ready, but it shows how large language models can help mine information in interesting new ways. Here’s a screenshot of the tool being used to search for the term “AI agents.” The two green squares closest to the news article and Reddit clusters represent research papers that could potentially be included in an article on efforts to build AI agents.

    Compliments of Sundai Club.

    [ad_2]

    Will Knight

    Source link

  • The US Could Finally Ban Inane Forced Password Changes

    The US Could Finally Ban Inane Forced Password Changes

    [ad_1]

    Researchers found a vulnerability in a Kia web portal that allowed them to track millions of cars, unlock doors, honk horns, and even start engines in seconds, just by reading the car’s license plate. The findings are the latest in a string of web bugs that have impacted dozen of carmakers. Meanwhile, a handful of Tesla Cybertrucks have been outfitted for war and are literally being-battle tested by Chechen forces fighting in Ukraine as part of Russia’s ongoing invasion.

    As Israel escalates its attacks on Lebanon, civilians on both sides of the conflict have been receiving ominous text messages—and authorities in each country are accusing the other of psychological warfare. The US government has increasingly condemned Russia-backed media outlets like RT for working closely with Russian intelligence—and many digital platforms have removed or banned their content. But they’re still influential and trusted alternative sources of information in many parts of the world.

    And there’s more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    A new draft of the US National Institute of Standards and Technology’s “Digital Identity Guidelines” finally takes steps to eliminate reviled password management practices that have been shown to do more harm than good. The recommendations, which will be mandatory for US federal government entities and serve as guidelines for everyone else, ban the practice of requiring users to periodically change their account passwords, often every 90 days.

    The policy of regularly changing passwords evolved out of a desire to ensure that people weren’t choosing easily guessable or reused passwords; but in practice, it causes people to choose simple or formulaic passwords so they will be easier to keep track of. The new recommendations also ban “composition rules,” like requiring a certain number or mix of capital letters, numbers, and punctuation marks in each password. NIST writes in the draft that the goal of the Digital Identity Guidelines is to provide “foundational risk management processes and requirements that enable the implementation of secure, private, equitable, and accessible identity systems.”

    The US Department of Justice unsealed charges on Friday against three Iranian men who allegedly compromised Donald Trump’s presidential campaign and leaked stolen data to media outlets. Microsoft and Google warned last month that an Iranian state-sponsored hacking group known as APT42 had targeted both the Joe Biden and Donald Trump presidential campaigns, and successfully breached the Trump campaign. The DOJ claims the hackers compromised a dozen people as part of its operation, including a journalist, a human rights advocate, and several former US officials. More broadly, the US government has said in recent weeks that Iran is attempting to interfere in the 2024 election.

    “The defendants’ own words made clear that they were attempting to undermine former President Trump’s campaign in advance of the 2024 U.S. presidential election,” Attorney General Merrick Garland said at a press conference on Friday. “We know that Iran is continuing with its brazen efforts to stoke discord, erode confidence in the US electoral process, and advance its malign activities.”

    The Irish Data Protection Commission fined Meta €91 million, or roughly $101 million, on Friday for a password storage lapse in 2019 that violated the European Union’s General Data Protection Regulation. Following a report by Krebs on Security, the company acknowledged in March 2019 that a bug in its password management systems had caused hundreds of millions of Facebook, Facebook Lite, and Instagram passwords to be stored without protection in plaintext in an internal platform. Ireland’s privacy watchdog launched its investigation into the incident in April 2019.

    “It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data,” Irish DPC deputy commissioner Graham Doyle said in a statement. “It must be borne in mind that the passwords, the subject of consideration in this case, are particularly sensitive, as they would enable access to users’ social media accounts.”

    The digital anonymity nonprofit the Tor Project is merging with privacy- and anonymity-focused Linux-based operating system Tails. Pavel Zoneff, the Tor Project’s communications director, wrote in a blog post on Thursday that the move will facilitate collaboration and reduce costs, while expanding both groups’ reach. “Tor and Tails provide essential tools to help people around the world stay safe online,” he wrote. “By joining forces, these two privacy advocates will pool their resources to focus on what matters most: ensuring that activists, journalists, other at-risk and everyday users will have access to improved digital security tools.”

    [ad_2]

    Lily Hay Newman

    Source link

  • Hackers Steal $243 Million In Bitcoin Scam – But Doxxed Themselves On Discord

    Hackers Steal $243 Million In Bitcoin Scam – But Doxxed Themselves On Discord

    [ad_1]

    Blockchain detective ZachXBT has exposed another set of hackers who used a social engineering scam to steal over $240 million in Bitcoin from a wealthy victim.

    The investigator said that both his efforts and the criminals’ own blunders have already led to “multiple arrests and millions frozen.”

    Scammed For 4000 BTC

    In mid-August, the scammers targeted a single creditor to Genesis – the institutional Bitcoin trading desk that went bankrupt in early 2023.

    First, the scammers called the victim pretending to be Google support using a spoofed phone number and gained access to the victim’s personal accounts. They then called again pretending to be Gemini support, warning the victim that their accounts were hacked.

    Through this, they prompted the victim to reset his two-factor authentication and send his Gemini funds to a compromised wallet. Meanwhile, the scammers fooled the victim into downloading the remote desktop application AnyDesk, which let them see the victim’s screen, and view his private key via Bitcoin Core.

    The hackers recorded their audio and screens as they celebrated pulling off the hack, which netted them 4,064 BTC worth $257 million at today’s price.

    “An initial tracing showed $243M split multiple ways between each party before funds quickly peeled off to 15+ exchanges immediately swapping back and forth between Bitcoin, Litecoin, Ethereum, and Monero,” added ZachXBT.

    Identifying The Culprits

    The investigator linked the distribution of the funds to the wallets of the parties involved with the theft. One of the three main culprits who went by “Wiz” was identified as Veer Chetal after he mistakenly leaked his full name during a screenshare.

    Chetal’s friend Light also leaked his real name, Aakaash, during a screen share. Greavys, whose real name is Malone Lam and was responsible for finding details related to the target in his mail, spent much of his stolen money on luxury cars, nightclubs, and giving Birkin bags to girls.

    Box (Jeandhil Serrano), the man who called the victim as a pretend Gemini exchange rep, also spent much of his funds on luxury goods. However, ZachXBT said both Box and Greavys mistakenly linked their “dirty funds” connected to centralized exchanges with their funds that were supposed to be private on multiple occasions.

    Yesterday evening, both Box and Greavys were arrested in Miami and LA. Over million of their stolen funds have been seized with help from Binance, and $500,000 has been returned back to the victim.

    An indictment of the case against both individuals was unsealed later on Thursday.

    SPECIAL OFFER (Sponsored)

    Binance Free $600 (CryptoPotato Exclusive): Use this link to register a new account and receive $600 exclusive welcome offer on Binance (full details).

    LIMITED OFFER 2024 at BYDFi Exchange: Up to $2,888 welcome reward, use this link to register and open a 100 USDT-M position for free!

    [ad_2]

    Andrew Throuvalas

    Source link

  • Did a Chinese University Hacking Competition Target a Real Victim?

    Did a Chinese University Hacking Competition Target a Real Victim?

    [ad_1]

    Capture the flag hacking contests at security conferences generally serve two purposes: to help participants develop and demonstrate computer hacking and security skills, and to assist employers and government agencies with discovering and recruiting new talent.

    But one security conference in China may have taken its contest a step further—potentially using it as a secret espionage operation to get participants to collect intelligence from an unknown target.

    According to two Western researchers who translated documentation for China’s Zhujian Cup, also known as the National Collegiate Cybersecurity Attack and Defense Competition, one part of the three-part competition, held last year for the first time, had a number of unusual characteristics that suggest its potentially secretive and unorthodox purpose.

    Capture the flag (CTF) and other types of hacking competitions are generally hosted on closed networks or “cyber ranges”—dedicated infrastructure set up for the contest so that participants don’t risk disrupting real networks. These ranges provide a simulated environment that mimics real-world configurations, and participants are tasked with finding vulnerabilities in the systems, obtaining access to specific parts of the network, or capturing data.

    There are two major companies in China that set up cyber ranges for competitions. The majority of the competitions give a shout out to the company that designed their range. Notably, Zhujian Cup didn’t mention any cyber range or cyber range provider in its documentation, leaving the researchers to wonder if this is because the contest was held in a real environment rather than a simulated one.

    The competition also required students to sign a document agreeing to several unusual terms. They were prohibited from discussing the nature of the tasks they were asked to do in the competition with anyone; they had to agree not to destroy or disrupt the targeted system; and at the end of the competition, they had to delete any backdoors they planted on the system and any data they acquired from it. And unlike other competitions in China the researchers examined, participants in this portion of the Zhujian Cup were prohibited from publishing social media posts revealing the nature of the competition or the tasks they performed as part of it.

    Participants also were prohibited from copying any data, documents, or printed materials that were part of the competition; disclosing information about vulnerabilities they found; or exploiting those vulnerabilities for personal purposes. If a leak of any of this data or material occurred and caused harm to the contest organizers or to China, according to the pledge that participants signed, they could be held legally responsible.

    “I promise that if any information disclosure incident (or case) occurs due to personal reasons, causing loss or harm to the organizer and the country, I, as an individual, will bear legal responsibility in accordance with the relevant laws and regulations,” the pledge states.

    The contest was hosted last December by Northwestern Polytechnical University, a science and engineering university in Xi’an, Shaanxi, that is affiliated with China’s Ministry of Industry and Information Technology and also holds a top-secret clearance to conduct work for the Chinese government and military. The university is overseen by China’s People’s Liberation Army.

    [ad_2]

    Kim Zetter

    Source link

  • This is How N. Korea is ‘Aggressively’ Attacking the Crypto Industry, According to the FBI

    This is How N. Korea is ‘Aggressively’ Attacking the Crypto Industry, According to the FBI

    [ad_1]

    The United States Federal Bureau of Investigation (FBI) has issued a paper alerting the public of “aggressive” attacks from North Korean hackers against the crypto industry and companies associated with digital asset investment products.

    According to the report, these attacks consist primarily of sophisticated social engineering tactics that even crypto employees and market participants well-versed in cybersecurity practices could fall victim to.

    N. Korean Hackers Target Crypto Firms

    These social engineering attacks are often complex, elaborate, and difficult to detect. The hackers have conducted research on multiple targets active in or connected to the crypto industry. The FBI observed pre-operational preparations suggesting these bad actors may attempt malicious cyber activities against these companies through their employees.

    “For companies active in or associated with the cryptocurrency sector, the FBI emphasizes North Korea employs sophisticated tactics to steal cryptocurrency funds and is a persistent threat to organizations with access to large quantities of cryptocurrency-related assets or products,” the U.S. agency stated.

    Before these groups of North Korean hackers attempt to gain unauthorized access to company networks and devices through employees, they look for their prospective victims on social media, particularly professional networking and employment-related platforms.

    The hackers incorporate the target’s personal details regarding their background, employment, or business interests to create customized fictional scenarios, such as new employment or corporate investment offers. They ensure these scenarios are uniquely appealing to the targeted persons.

    Impersonators and “Normal” Requests

    Once the bad actors initiate contact with the targets, they strive to maintain rapport to build familiarity, trust, and a sense of legitimacy. Then, they attack when the victims are unsuspecting or in situations that seem natural by delivering malware to their devices or company networks.

    Some seemingly natural situations include requests to enable video call functionalities supposedly blocked due to a victim’s location, requests to download applications or execute codes on company devices or networks, requests to conduct pre-employment tests and debugging exercises, and insistence on using custom software for simple tasks.

    These attackers also impersonate high-profile individuals, technology experts, and recruiters on professional networking websites.

    “To increase the credibility of their impersonations, the actors leverage realistic imagery, including pictures stolen from open social media profiles of the impersonated individual. These actors may also use fake images of time-sensitive events to induce immediate action from intended victims,” the agency added.

    The FBI has instructed crypto firms to remain alert and affected entities to take proper action to fix the issues before they cause significant harm.

    SPECIAL OFFER (Sponsored)

    Binance Free $600 (CryptoPotato Exclusive): Use this link to register a new account and receive $600 exclusive welcome offer on Binance (full details).

    LIMITED OFFER 2024 at BYDFi Exchange: Up to $2,888 welcome reward, use this link to register and open a 100 USDT-M position for free!

    [ad_2]

    Mandy Williams

    Source link