ReportWire

Tag: Hacking

  • Russia’s Most Notorious Special Forces Unit Now Has Its Own Cyber Warfare Team

    Russia’s Most Notorious Special Forces Unit Now Has Its Own Cyber Warfare Team

    Russia’s military intelligence agency, the GRU, has long had a reputation as one of the world’s most aggressive practitioners of sabotage, assassination, and cyber warfare, with hackers who take pride in working under the same banner as violent special forces operators. But one new group within that agency shows how the GRU may be intertwining physical and digital tactics more tightly than ever before: a hacking team, which has emerged from the same unit responsible for Russia’s most notorious physical tactics, including poisonings, attempted coups, and bombings inside Western countries.

    A broad group of Western government agencies from countries including the US, the UK, Ukraine, Australia, Canada, and five European countries on Thursday revealed that a hacker group known as Cadet Blizzard, Bleeding Bear, or Greyscale—one that has launched multiple hacking operations targeting Ukraine, the US, and other countries in Europe, Asia, and Latin America—is in fact part of the GRU’s Unit 29155, the division of the spy agency known for its brazen acts of physical sabotage and politically motivated murder. That unit has been tied in the past, for instance, to the attempted poisoning of GRU defector Sergei Skripal with the Novichok nerve agent in the UK, which led to the death of two bystanders, as well as another assassination plot in Bulgaria, the explosion of an arms depot in the Czech Republic, and a failed coup attempt in Montenegro.

    Now that infamous section of the GRU appears to have developed its own active team of cyber warfare operators—distinct from those within other GRU units such as Unit 26165, broadly known as Fancy Bear or APT28, and Unit 74455, the cyberattack-focused team known as Sandworm. Since 2022, GRU Unit 29155’s more recently recruited hackers have taken the lead on cyber operations, including with the data-destroying wiper malware known as Whispergate, which hit at least two dozen Ukrainian organizations on the eve of Russia’s February 2022 invasion, as well as the defacement of Ukrainian government websites and the theft and leak of information from them under a fake “hacktivist” persona known as Free Civilian.

    Cadet Blizzard’s identification as a part of GRU Unit 29155 shows how the agency is further blurring the line between physical and cyber tactics in its approach to hybrid warfare, according to one of multiple Western intelligence agency officials whom WIRED interviewed on condition of anonymity because they weren’t authorized to speak using their names. “Special forces don’t normally set up a cyber unit that mirrors their physical activities,” one official says. “This is a heavily physical operating unit, tasked with the more gruesome acts that the GRU is involved in. I find it very surprising that this unit that does very hands-on stuff is now doing cyber things from behind a keyboard.”

    In addition to the joint public statement revealing Cadet Blizzard’s link to the GRU’s unit 29155, the US Cybersecurity and Infrastructure Security Agency published an advisory detailing the group’s hacking methods and ways to spot and mitigate them. The US Department of Justice indicted five members of the group by name, all in absentia, in addition to a sixth who had been previously charged earlier in the summer without any public mention of Unit 29155.

    “The GRU’s WhisperGate campaign, including targeting Ukrainian critical infrastructure and government systems of no military value, is emblematic of Russia’s abhorrent disregard for innocent civilians as it wages its unjust invasion,” the US Justice Department’s assistant attorney general Matthew G. Olsen wrote in a statement. “Today’s indictment underscores that the Justice Department will use every available tool to disrupt this kind of malicious cyber activity and hold perpetrators accountable for indiscriminate and destructive targeting of the United States and our allies.”

    Andy Greenberg

    Source link

  • Taylor Swift Concert Terror Plot Was Thwarted by Key CIA Tip

    Taylor Swift Concert Terror Plot Was Thwarted by Key CIA Tip

    Pavel Durov, the founder and CEO of the communication app Telegram, was arrested in France on Saturday as part of an investigation into his and Telegram’s alleged failure to moderate illegal content on the platform, among other allegations. After being detained for four days, he was charged on Wednesday evening, barred from leaving France, and released on the condition of posting a €5 million ($5.5 million) bail and reporting to a French police station twice a week. The Paris prosecutor’s office said on Wednesday that Durov faces complicity charges related to child sexual abuse material and drug trafficking, as well charges for importing cryptology without prior declaration, and a “near-total absence” of cooperation with French authorities.

    “Nudify” deepfake websites that generate images of people’s naked bodies without their consent have been incorporating mainstream single sign-on authentication systems into their websites, a WIRED investigation found. Discord and Apple are terminating some developers’ accounts over this usage.

    Microsoft published research on Wednesday about a new multistage backdoor that the notorious Iranian hacking group APT 33 or Peach Sandstorm has been using to target victims in sectors including satellite, communications equipment, and oil and gas. And Google researchers found that suspected Russian hackers compromised Mongolian government websites between November 2023 and July 2024 and then infected vulnerable users who visited the sites with malware. Crucially, the attackers compromised targets using exploits that were identical or very similar to hacking tools created by the commercial spyware vendors NSO Group and Intellexa.

    And there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    The US Central Intelligence Agency provided Austrian law enforcement with crucial intelligence that led to the arrest of suspects who were allegedly plotting to attack Taylor Swift concerts in Austria at the beginning of the month. All three of the singer’s planned concerts were canceled at Vienna’s Ernst Happel Stadium because of the threat. CIA deputy director David Cohen said at the Insa intelligence conference on Wednesday, “Within my agency and others there were people who thought that was a really good day for Langley and not just the Swifties in my workforce.”

    The central suspect is a 19-year-old Austrian of North Macedonian background who reportedly made a full confession. Austrian law enforcement also arrested an 18-year-old and a 17-year-old in relation to the plot. Cops also reportedly interrogated a 15-year-old. The plot was allegedly inspired by the Islamic State and included plans to attack fans outside the venue with knives or explosives. Earlier this month, Austrian interior minister Gerhard Karner said foreign intelligence agencies contributed to the investigation because Austrian law bars text message surveillance.

    “They were plotting to kill a huge number, tens of thousands of people at this concert, including I am sure many Americans, and were quite advanced in this,” the CIA’s Cohen said at the conference. “The Austrians were able to make those arrests because the agency and our partners in the intelligence community provided them information about what this ISIS-connected group was planning to do.”

    Hackers who may be backed by the Chinese government have been exploiting a recently patched vulnerability in network management virtualization software known as Versa Director to compromise at least four US-based internet service providers and steal authentication credentials used by their customers. Researchers from Lumen’s Black Lotus Labs, said on Thursday that the attacks began as early as June 12 and are likely still going on. Hackers exploit the Versa Director vulnerability to install remote access malware that Lumen dubbed allow “VersaMem.”

    “Given the severity of the vulnerability, the implications of compromised Versa Director systems, and the time that has now elapsed to allow Versa customers to patch the vulnerability, Black Lotus Labs felt it was appropriate to release this information at this time,” the researchers wrote in a blog post. “Lumen Technologies shared threat intelligence to warn appropriate US government agencies of the emerging risks that could impact our nation’s strategic assets.”

    The movie studio coalition known as the Alliance for Creativity and Entertainment said on Thursday that Hanoi police have investigated and taken down the Vietnam-based pirate streaming service Fmovies and its affiliates. The working group said it collaborated with law enforcement and provided information about Fmovies, which it called “the largest pirate streaming operation in the world.” The group added that Fmovies and its affiliate sites—which included bflixz, flixtorz, movies7, myflixer, and aniwave—had more than 6.7 billion visits between January 2023 and June 2024. The law enforcement operation also led to the takedown of video hosting provider Vidsrc.to and its affiliates because these services were allegedly “operated by the same suspects.” Hanoi police have arrested two men in connection with the case.

    Following a digital attack against dozens of French museums during the Olympic Games earlier this month, the ransomware gang known as Brain Cipher has claimed responsibility for the hacks and is threatening to leak 300 GB of stolen data from the museums. Le Grand Palais and dozens of other French national museums and cultural organizations are overseen by Réunion des Musées Nationaux – Grand Palais and reportedly all use some shared digital infrastructure, which the attackers targeted.

    Lily Hay Newman

    Source link

  • Powerful Spyware Exploits Enable a New String of ‘Watering Hole’ Attacks

    Powerful Spyware Exploits Enable a New String of ‘Watering Hole’ Attacks

    In recent years, elite commercial spyware vendors like Intellexa and NSO Group have developed an array of powerful hacking tools that exploit rare and unpatched “zero-day” software vulnerabilities to compromise victim devices. And increasingly, governments around the world have emerged as the prime customers for these tools, compromising the smartphones of opposition leaders, journalists, activists, lawyers, and others. On Thursday, though, Google’s Threat Analysis Group is publishing findings about a series of recent hacking campaigns—seemingly carried out by Russia’s notorious APT29 Cozy Bear gang—that incorporate exploits very similar to ones developed by Intellexa and NSO Group into ongoing espionage activity.

    Between November 2023 and July 2024, the attackers compromised Mongolian government websites and used the access to conduct “watering hole” attacks, in which anyone with a vulnerable device who loads a compromised website gets hacked. The attackers set up the malicious infrastructure to use exploits that “were identical or strikingly similar to exploits previously used by commercial surveillance vendors Intellexa and NSO Group,” Google’s TAG wrote on Thursday. The researchers say they “assess with moderate confidence” that the campaigns were carried out by APT29.

    These spyware-esque hacking tools exploited vulnerabilities in Apple’s iOS and Google’s Android that had largely already been patched. Originally, they were deployed by the spyware vendors as unpatched, zero-day exploits, but in this iteration, the suspected Russian hackers were using them to target devices that hadn’t been updated with these fixes.

    “While we are uncertain how suspected APT29 actors acquired these exploits, our research underscores the extent to which exploits first developed by the commercial surveillance industry are proliferated to dangerous threat actors,” the TAG researchers wrote. “Moreover, watering hole attacks remain a threat where sophisticated exploits can be utilized to target those that visit sites regularly, including on mobile devices. Watering holes can still be an effective avenue for … mass targeting a population that might still run unpatched browsers.”

    It is possible that the hackers purchased and adapted the spyware exploits or that they stole them or acquired them through a leak. It is also possible that the hackers were inspired by commercial exploits and reverse engineered them by examining infected victim devices.

    “NSO does not sell its products to Russia,” Gil Lainer, NSO Groups vice president for global communications, told WIRED in a statement. “Our technologies are sold exclusively to vetted US & Israel-allied intelligence and law enforcement agencies. Our systems and technologies are highly secure and are continuously monitored to detect and neutralize external threats.”

    Between November 2023 and February 2024, the hackers used an iOS and Safari exploit that was technically identical to an offering that Intellexa had first debuted a couple of months earlier as an unpatched zero-day in September 2023. In July 2024, the hackers also used a Chrome exploit adapted from an NSO Group tool that first appeared in May 2024. This latter hacking tool was used in combination with an exploit that had strong similarities to one Intellexa debuted back in September 2021.

    When attackers exploit vulnerabilities that have already been patched, the activity is known as “n-day exploitation,” because the vulnerability still exists and can be abused in unpatched devices as time passes. The suspected Russian hackers incorporated the commercial spyware adjacent tools, but constructed their overall campaigns—including malware delivery and activity on compromised devices—differently than the typical commercial spyware customer would. This indicates a level of fluency and technical proficiency characteristic of an established and well-resourced state-backed hacking group.

    “In each iteration of the watering hole campaigns, the attackers used exploits that were identical or strikingly similar to exploits from [commercial surveillance vendors], Intellexa and NSO Group,” TAG wrote. “We do not know how the attackers acquired these exploits. What is clear is that APT actors are using n-day exploits that were originally used as 0-days by CSVs.”

    Updated at 2pm ET, August 29, 2024: Added comment from NSO Group.

    Lily Hay Newman

    Source link

  • The US Navy Has Run Out of Pants

    The US Navy Has Run Out of Pants

    The United States Defense Department has ideas about a dramatic strategy for defending Taiwan against a Chinese military offensive that would involve deploying an “unmanned hellscape” consisting of thousands of drones buzzing around the island nation. Meanwhile, the US National Institute of Standards and Technology announced a red-team hacking competition this week with the AI ethics nonprofit Humane Intelligence to find flaws and biases in generative AI systems.

    WIRED took a closer look at the Telegram channel and website known as Deep State that uses public data and secret intelligence to power its live-tracker map of Ukraine’s evolving front line. Protesters went to Citi Field in New York on Wednesday to raise awareness about the serious privacy risks of deploying facial recognition systems at sporting venues. The technology has increasingly been implemented at stadiums and arenas across the country with little oversight. And Amazon Web Services updated its instructions for how customers should implement authentication in its Application Load Balancer, after researchers found an implementation issue that they say could expose misconfigured web apps.

    But wait, there’s more! Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    US Navy officials confirmed to Military.com this week that pants for the standard Navy Working Uniform (NWU) are out of stock at Navy Exchanges and are in perilously low supply across the sea service’s distribution channels. The Navy’s Exchange Service Command is “experiencing severe shortages of NWU trousers” both in stores and online, according to spokesperson Courtney Williams. Sailors have been noticing out-of-stock notifications online, which state that pants are “not available for purchase in any size.” Williams said that current stock around the world is at 13 percent and that the top priority right now is providing pants to new recruits at Recruit Training Command in Illinois, the Naval Academy Preparatory School in Rhode Island, and the officer training schools.

    The shortage seems to have resulted from issues with the Defense Logistics Agency’s pants pipeline. Military.com reports that signs currently inside Navy Exchanges say the shortage is “due to Defense Logistics Agency vendor issues.” Williams said the Command has “been in communication with DLA on a timeline for the uniform’s production and supply chain.”

    Mikia Muhammad, a spokesperson for the Defense Logistics Agency, told Military.com that the first pants restocks are scheduled for October, but these supplies will go to recruits and training programs. She said that Navy exchanges should expect “full support” beginning in January.

    A joint statement on Monday by the FBI, the Office of the Director of National Intelligence, and the Cybersecurity and Infrastructure Security Agency formally accused Iran of conducting a hack-and-leak operation against Donald Trump’s presidential campaign. Trump himself had accused Iran in a social media post on August 10, following a report from Microsoft on August 9 about Iranian hackers targeting US political campaigns. The Iranian government denies the accusation.

    “The [Intelligence Community] is confident that the Iranians have through social engineering and other efforts sought access to individuals with direct access to the presidential campaigns of both political parties,” the US agencies wrote. “Such activity, including thefts and disclosures, are intended to influence the US election process.”

    Politico reported on August 10 that Iran had breached the Trump campaign, and an entity calling itself “Robert” had contacted the publication offering alleged stolen documents. The same entity also contacted The New York Times and The Washington Post hawking similar documents.

    The popular flight-tracking service FlightAware said this week that a “configuration error” in its systems exposed personal customer data, including names, email addresses, and even some Social Security numbers. The company discovered the exposure on July 25 but said in a breach notification to the attorney general of California that the situation may date as far back as January 2021. The company is mandating that all affected users reset their account passwords.

    The company said in its public statement that the exposed data includes “user ID, password, and email address. Depending on the information you provided, the information may also have included your full name, billing address, shipping address, IP address, social media accounts, telephone numbers, year of birth, last four digits of your credit card number, information about aircraft owned, industry, title, pilot status (yes/no), and your account activity (such as flights viewed and comments posted).” It also said in its disclosure to California, “Additionally, our investigation has revealed that your Social Security Number may have been exposed.”

    Since European law enforcement agencies hacked the end-to-end encrypted phone company Sky in 2021, the communications they compromised have been used as evidence in numerous EU investigations and criminal cases. But a review of court records by 404 Media and Court Watch showed this week that US agencies have also been leaning on the trove of roughly half a billion chat messages. US law enforcement has used the data in multiple drug-trafficking prosecutions, particularly to pursue alleged smugglers who transport cocaine with commercial ships and speedboats.

    Lily Hay Newman

    Source link

  • Iranian hackers targeted WhatsApp accounts of staffers in Biden, Trump administrations, Meta says

    Iranian hackers targeted WhatsApp accounts of staffers in Biden, Trump administrations, Meta says

    WASHINGTON — The same Iranian hacking group believed to have targeted both the Democratic and Republican presidential campaigns tried to go after the WhatsApp accounts of staffers in the administrations of President Joe Biden and former President Donald Trump, Meta Platforms said Friday.

    Meta said it discovered the network of hackers, who posed as tech support agents for companies including AOL, Microsoft, Yahoo and Google, after individuals who received the suspicious WhatsApp messages reported them. Meta’s investigators linked the activity to the same network blamed for the hacking incident reported by Trump’s campaign.

    The FBI this week said a hack by Iran of the Trump campaign and an attempted breach of the Biden-Harris campaign was part of a broader Iranian effort to interfere with the U.S. presidential election.

    A statement Friday from Meta, the parent of Facebook and Instagram, said that the hackers had tried to target the WhatsApp accounts of individuals in the Middle East, the United States and the United Kingdom, as well as political and diplomatic officials — including unidentified officials associated with the Trump and Biden administrations. A “small cluster” of accounts was blocked by Meta, the company said.

    “We have not seen evidence of the targeted WhatsApp accounts being compromised, but out of an abundance of caution, we’re sharing our findings publicly, in addition to sharing information with law enforcement and our industry peers,” Meta said in a statement.

    In a report this month, Google’s threat intelligence arm said the same Iranian group, which it linked to the country’s Revolutionary Guard, had tried to infiltrate the personal email accounts of roughly a dozen people linked to Biden and Trump since May. That report expanded on a separate study released days earlier by Microsoft that revealed suspected Iranian cyber intrusion in this year’s presidential election.

    U.S. intelligence officials say Iran’s increasingly aggressive use of cyberattacks and disinformation has several motives: to confuse and polarize voters in an effort to undermine confidence in U.S. democracy, to erode support for Israel, and to oppose candidates that it believes will increase tension between Washington and Iran.

    Iran has vowed revenge against Trump, whose administration ended a nuclear deal with Iran, reimposed sanctions and ordered the killing of an Iranian Gen. Qassem Soleimani.

    In July, Director of National Intelligence Avril Haines said Iran’s government gave covert support to American protests against Israel’s war against Hamas in Gaza. Groups linked to Iran posed as online activists, encouraged campus protests and provided financial support to some protest groups, Haines said.

    Messages left with the Trump and Harris campaigns were not immediately returned Friday.

    Source link

  • US intelligence officials say Iran is to blame for hacks targeting Trump, Biden-Harris campaigns

    US intelligence officials say Iran is to blame for hacks targeting Trump, Biden-Harris campaigns

    WASHINGTON — U.S. intelligence officials said Monday they were confident that Iran was responsible for the hack of Donald Trump’s presidential campaign, casting the cyber intrusion as part of a brazen and broader effort by Tehran to interfere in American politics and potentially shape the outcome of the election.

    The assessment from the FBI and other federal agencies was the first time the U.S. government has assigned blame for hacks that have raised anew the threat of foreign election interference and underscored how Iran, in addition to more sophisticated adversaries like Russia and China, remains a top concern. Besides breaching the Trump campaign, officials also believe that Iran tried to hack into the presidential campaign of Kamala Harris.

    The hacking and similar activities, federal officials said, are meant to sow discord, exploit divisions within American society and possibly to influence the outcome of elections that Iran perceives to be “particularly consequential in terms of the impact they could have on its national security interests,” officials said.

    “We have observed increasingly aggressive Iranian activity during this election cycle, specifically involving influence operations targeting the American public and cyber operations targeting Presidential campaigns,” said the statement released by the FBI, the Office of the Director of National Intelligence and the Cybersecurity and Infrastructure Security Agency.

    Iran’s mission to the United Nations denied the allegations as “unsubstantiated and devoid of any standing,” saying that Iran had neither the motive nor intention to interfere with the election. It challenged the U.S. to provide evidence and said if the U.S. does so, “we will respond accordingly.”

    The FBI statement was released at a time of significant tensions between Washington and Tehran as the U.S. hopes to halt or limit a threatened retaliatory strike on Israel over the assassination of Hamas official Ismail Haniyeh in Iran. In addition, an Israeli strike last month in southern Beirut killed Hezbollah’s top commander, but while Tehran and Iran-backed Hezbollah have vowed to retaliate, they have not yet launched strikes as diplomatic endeavors and Gaza cease-fire talks continue in Qatar.

    The U.S. did not detail how it reached the conclusion that Iran was responsible, nor did it describe the nature of any information that may have been stolen from the Trump campaign. But it said the intelligence community was confident “the Iranians have through social engineering and other efforts sought access to individuals with direct access to the Presidential campaigns of both political parties.”

    At least three staffers in the Biden-Harris campaign were targeted with phishing emails, but investigators have uncovered no evidence the attempt was successful, The Associated Press reported last week.

    “Such activity, including thefts and disclosures, are intended to influence the U.S. election process. It is important to note that this approach is not new. Iran and Russia have employed these tactics not only in the United States during this and prior federal election cycles but also in other countries around the world,” the statement said.

    U.S. officials have been on high alert in recent election cycles for foreign influence campaigns and outright interference as in 2016, when Russian military intelligence operatives hacked the campaign of Democratic nominee Hillary Clinton and orchestrated the release of politically damaging emails through the website WikiLeaks.

    Iran has more recently emerged as an aggressive threat to American elections. In 2020, U.S. intelligence officials say, Iran carried out an influence campaign aimed at harming Trump’s reelection bid that was probably approved by Supreme Leader Ayatollah Ali Khamenei and was the subject of an unusual evening news conference featuring FBI Director Christopher Wray and other officials.

    U.S. officials also have expressed alarm about Tehran’s efforts to seek retaliation for a 2020 strike on an Iranian general that was ordered by Trump.

    The Trump campaign disclosed on Aug. 10 that it had been hacked and said Iranian actors had stolen and distributed sensitive internal documents. At least three news outlets — Politico, The New York Times and The Washington Post — were leaked confidential material from inside the Trump campaign. So far, each has refused to reveal any details about what it received.

    Politico reported that it began receiving emails on July 22 from an anonymous account. The source — an AOL email account identified only as “Robert” — passed along what appeared to be a research dossier the campaign had apparently done on the Republican vice presidential nominee, Ohio Sen. JD Vance. The document was dated Feb. 23, almost five months before Trump selected Vance as his running mate.

    The U.S. government’s assessment aligns with the findings of private companies.

    Earlier this month, Microsoft issued a report on Iranian agents’ attempts to interfere in this year’s election. It said Iran had impersonated activists and created fake news targeted to voters on opposite sides of the political spectrum. The report also cited an instance of an Iranian military intelligence unit in June sending “a spear-phishing email to a high-ranking official of a presidential campaign from a compromised email account of a former senior advisor.”

    In a separate report, Google said an Iranian group linked to the country’s Revolutionary Guard has tried to infiltrate the personal email accounts of roughly a dozen people linked to President Joe Biden and Trump since May.

    ____

    Associated Press writer Edith M. Lederer at the United Nations contributed to this report.

    Source link

  • French Authorities Arrest Duo in Connection to Holograph’s $14.4M Hack

    French Authorities Arrest Duo in Connection to Holograph’s $14.4M Hack

    Investigations into a multi-million dollar hack on the omnichain tokenization platform Holograph have begun to yield results. French authorities have arrested two individuals who may have been involved in the attack.

    According to a tweet by the official Holograph X account, the Italian Directorate of Anti-Mafia Investigations, in collaboration with multiple enforcement agencies, including Europol, France’s Office for the Prevention of Cybercrime, and the Paris Search and Intervention Brigade, have apprehended suspects tied to the Holograph hack, confiscating assets and electronics as part of the arrests.

    The Holograph Hack

    On June 13, a cybercriminal exploited a vulnerability in the Holograph operator contract and minted 1 billion HLG tokens valued at $14.4 million. HLG is the protocol’s native token. Within hours after the attack, the hacker converted the stolen assets to Tether (USDT) and made away with the stablecoins.

    On-chain analysts found data that suggested that a rogue developer had executed the attack after making preparations roughly a month in advance. The wallet address that received the minted supply was funded 26 days before the exploit.

    The Holograph team quickly alerted law enforcement agencies, and investigations have been ongoing.

    Law enforcement agencies and cyber investigators traced the attacks to two men in their thirties residing in Italy. They were arrested and detained on August 9 and will soon be extradited to France to face charges. Holograph said their names could not be publicized based on instructions from French authorities and for the sake of further investigations.

    “The broader investigation is still very fluid — the team will share more information on asset recovery for the Holograph ecosystem as the proceedings develop,” the protocol added.

    HLG Surges 62%

    The Holograph attack took a toll on the value of HLG, as the token plunged 80% from $0.014 to a low of $0.0029 in less than ten hours. The token’s market cap slumped from $22 million to $4.8 million, and the value of the stolen stash reduced from $14.4 million to $7 million.

    Although HLG’s market cap is currently below $3.44 million, the token has reacted to the news of the arrests, surging 62% from $0.0016 to $0.0026. At the time of writing, HLG was hovering around $0.0024, up 41% in the past 24 hours.

    SPECIAL OFFER (Sponsored)

    Binance Free $600 (CryptoPotato Exclusive): Use this link to register a new account and receive $600 exclusive welcome offer on Binance (full details).

    LIMITED OFFER 2024 at BYDFi Exchange: Up to $2,888 welcome reward, use this link to register and open a 100 USDT-M position for free!

    Mandy Williams

    Source link

  • Geofence Warrants Ruled Unconstitutional—but That’s Not the End of It

    Geofence Warrants Ruled Unconstitutional—but That’s Not the End of It

    The 2024 US presidential election is entering its final stretch, which means state-backed hackers are slipping out of the shadows to meddle in their own special way. That includes Iran’s APT42, a hacker group affiliated with Iran’s Islamic Revolutionary Guard Corps, which Google’s Threat Analysis Group says targeted nearly a dozen people associated with Donald Trump’s and Joe Biden’s (now Kamala Harris’) campaigns.

    The rolling disaster that is the breach of data broker and background-check company National Public Data is just beginning. While the breach of the company happened months ago, the company only acknowledged it publicly on Monday after someone posted what they claimed was “2.9 billion records” of people in the US, UK, and Canada, including names, physical addresses, and Social Security numbers. Ongoing analysis of the data, however, shows the story is far messier—as are the risks.

    You can now add bicycle shifters and gym lockers to the list of things that can be hacked. Security researchers revealed this week that Shimano’s Di2 wireless shifters can be vulnerable to various radio-based attacks, which could allow someone to change a rider’s gears remotely or prevent them from changing gears at a crucial moment in a race. Meanwhile, other researchers found that it’s possible to extract the administrator keys to electronic lockers used in gyms and offices around the world, potentially giving a criminal access to every locker at a single location.

    If you use a Google Pixel phone, don’t let it out of your sight: An unpatched vulnerability in a hidden Android app called Showcase.apk could give an attacker the ability to gain deep access to your device. Exploiting the vulnerability may require physical access to a targeted device, but researchers at iVerify who discovered the flaw say it may also be possible through other vulnerabilities. Google says it plans to release a fix “in the coming weeks,” but that’s not good enough for data analytics firm and US military contractor Palantir, which will stop using all Android devices due to what it believes was an insufficient response from Google.

    But that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    A US federal appeals court ruled last week that so-called geofence warrants violate the Fourth Amendment’s protections against unreasonable searches and seizures. Geofence warrants allow police to demand that companies such as Google turn over a list of every device that appeared at a certain location at a certain time. The US Fifth Circuit Court of Appeals ruled on August 9 that geofence warrants are “categorically prohibited by the Fourth Amendment” because “they never include a specific user to be identified, only a temporal and geographic location where any given user may turn up post-search.” In other words, they’re the unconstitutional fishing expedition that privacy and civil liberties advocates have long asserted they are.

    Google, which collects the location histories of tens of millions of US residents and is the most frequent target of geofence warrants, vowed late last year that it was changing how it stores location data in such a way that geofence warrants may no longer return the data they once did. Legally, however, the issue is far from settled: The Fifth Circuit decision applies only to law enforcement activity in Louisiana, Mississippi, and Texas. Plus, because of weak US privacy laws, police can simply purchase the data and skip the pesky warrant process altogether. As for the appellants in the case heard by the Fifth Circuit, well, they’re no better off: The court found that the police used the geofence warrant in “good faith” when it was issued in 2018, so they can still use the evidence they obtained.

    The Committee on Foreign Investment in the US (CFIUS) fined German-owned T-Mobile a record $60 million this week for its mishandling of data during its integration with US-based Sprint following the companies’ merger in 2020. According to CFIUS, “T-Mobile failed to take appropriate measures to prevent unauthorized access to certain sensitive data,” in violation of a National Security Agreement the company signed with the committee, which assesses the national security implications of foreign business deals with US companies. T-Mobile said in a statement that technical issues impacted “information shared from a small number of law enforcement information requests.” While the company claims to have acted “quickly” and “in a timely manner,” CFIUS claims T-Mobile “failed to report some incidents of unauthorized access promptly to CFIUS, delaying the Committee’s efforts to investigate and mitigate any potential harm.”

    The 12-year saga that is the prosecution of Kim Dotcom inched forward this week with the New Zealand justice minister approving the US’s request to extradite the controversial entrepreneur. Dotcom created the file-sharing service Megaupload, which US authorities say was used for widespread copyright infringement. The US seized Megaupload in 2012 and indicted Dotcom on charges related to racketeering, copyright infringement, and money laundering. Dotcom has denied any wrongdoing but lost an attempt to block the extradition in 2017 and has been fighting it ever since. Despite the justice minister’s decision, Dotcom vowed in a post on X to remain in the country where he’s been a legal resident since 2010. “I love New Zealand,” he wrote. “I’m not leaving.”

    The growing scourge of deepfake pornography—explicit images that digitally “undress” people without their consent—may have finally hit a major legal roadblock. San Francisco’s chief deputy city attorney, Yvonne Meré—and the City of San Francisco by extension—has filed a lawsuit against the 16 most popular “nudification” websites. These sites and apps allow people to make explicit deepfake images of virtually anyone, but they have increasingly been used by boys to make sexual abuse material of their underage female classmates. While several states have criminalized the creation and distribution of AI-generated sexual abuse material of minors, Meré’s lawsuit effectively seeks to shut down the sites entirely.

    Andrew Couts

    Source link

  • A Single Iranian Hacker Group Targeted Both Presidential Campaigns, Google Says

    A Single Iranian Hacker Group Targeted Both Presidential Campaigns, Google Says

    When Donald Trump’s presidential campaign publicly stated last week that it had been successfully targeted by Iranian hackers, the news may have initially seemed like a sign that the Middle Eastern country was particularly focused on the candidate whom it perceived to take the most hawkish approach to its regime. It’s since become clearer that Iran has had the Democrats in the sights of its cyber operations, too. Now Google’s cybersecurity analysts have confirmed that both campaigns were targeted not simply by Iran but by the same group of hackers working in service of Iran’s Revolutionary Guard Corps.

    Google’s Threat Analysis Group on Wednesday published a new report on APT42, a group it says has aggressively sought to compromise both the Democratic and Republican campaigns for president, as well as Israeli military, government, and diplomatic organizations. In May and June, APT42, which is believed to be working in service of Iran’s Revolutionary Guard Corps (IRGC), targeted about a dozen people associated with both Trump and Joe Biden, including current and former government officials and individuals associated with the two political campaigns. APT42 continues to target Republican and Democratic campaign officials alike, according to Google.

    “In terms of collection, they’re hitting all sides,” says John Hultquist, who leads threat intelligence at Google-owned cybersecurity firm Mandiant, which works closely with its Threat Analysis Group. Hultquist notes that equal-opportunity cyberspying doesn’t come as a surprise, given that APT42 also targeted both the Biden and Trump campaigns in 2020 as well. APT42’s targeting doesn’t necessarily speak to its preference for a single candidate, he says, so much as the fact that both candidates, Trump and now Vice President Kamala Harris, are of enormous significance to the Iranian government. “They’re interested in both candidates because these are the individuals who are charting the future of American policy in the Middle East,” Hultquist says.

    Only one campaign, however, appears to have had its sensitive files not only successfully breached by the Iranian hackers but also leaked to the press, in an apparent replay of Russia’s 2016 hack-and-leak operation that targeted Hillary Clinton’s campaign. Politico, The Washington Post, and The New York Times have all said they’ve been offered documents allegedly taken from the Trump campaign, in some cases by a source known as “Robert.”

    Whether those files were in fact compromised by APT42 remains unconfirmed. Microsoft noted last week that APT42, which it calls Mint Sandstorm, had in June targeted a “high-ranking official on a presidential campaign” by exploiting a hacked email account of another “former senior adviser” to the campaign. Google in its new report also notes that APT42 “successfully gained access to the personal Gmail account of a high-profile political consultant.”

    While neither company has offered any confirmation of which individual or individuals may have been successfully hacked by the Iranian group, Trump adviser Roger Stone has revealed that he was alerted by Microsoft and then by the FBI that both his Microsoft and Gmail accounts were compromised by hackers.

    Andy Greenberg

    Source link

  • Your Gym Locker May Be Hackable

    Your Gym Locker May Be Hackable

    Thousands of electronic lockers found in gyms, offices, and schools could be vulnerable to attacks by criminals using cheap hacking tools to access administrator keys, according to new research.

    At the Defcon security conference on Sunday, security researchers Dennis Giese and “braelynn” demonstrated a proof-of-concept attack showing how digital management keys could be extracted from lockers, copied, and then used to open other lockers in the same location. The researchers focused on various models of electronic locks from two of the world’s biggest manufacturers, Digilock and Schulte-Schlagbaum.

    Over the past few years, the researchers, who both have backgrounds in lock picking, have been examining various electronic locks that use numerical keypads, allowing people to set and open them with a PIN. The work comes on the back of various examples of hotel door locks being found to be hackable, vulnerabilities in high-security locks, and commercial safes being alleged to have backdoors.

    For the research, Giese and braelynn purchased electronic locks on eBay, snapping up those sold after some gyms closed during the Covid-19 pandemic and from other failed projects. Giese focused on Digilock, while braelynn looked at Schulte-Schlagbaum. Over the course of the research, they looked at legacy models from Digilock dating from 2015 to 2022 and models from Schulte-Schlagbaum from 2015 to 2020. (They also purchased some physical management keys for Digilock systems.)

    Showing how security flaws could be abused by a prepared hacker, the researchers say they can take the electronic lock apart, then extract the device’s firmware and stored data. This data, Giese says, can contain PINs that have been set, management keys, and programming keys. The manager key ID can be copied to a Flipper Zero or cheap Arduino circuit board and used to open other lockers, Giese says.

    “If you access one lock, we can open all of them in whatever the unit is—the whole university, the whole company,” Giese says. “We can clone and emulate keys very easily, and the tools aren’t that complicated.” Whoever owns the lockers manages them, Giese says.

    Ahead of developing this proof-of-concept attack, Giese says, it took some time and effort to understand how the locker systems function. They took the locks apart and used cheap debugging tools to access the devices’ erasable, programmable read-only memory, known as EEPROM. Often, in the locks they tested, this was not secured, allowing data to be pulled from the system.

    “From the EEPROM, we can pull out the programming key ID, all manager key IDs, and the user PIN/ User RFID UID,” Giese says. “Newer locks erase the set user PIN when the locker is unlocked. But the PIN remains if the locker was opened with a manager key/programming key.”

    The researchers say they reported the findings to both impacted companies, adding they had spoken to Digilock about the findings. Digilock tells WIRED it has issued a fix for vulnerabilities found. The researchers say Schulte-Schlagbaum did not respond to their reports; the company did not respond to WIRED’s request for comment.

    Matt Burgess

    Source link

  • Thousands of Corporate Secrets Were Left Exposed. This Guy Found Them All

    Thousands of Corporate Secrets Were Left Exposed. This Guy Found Them All

    If you know where to look, plenty of secrets can be found online. Since the fall of 2021, independent security researcher Bill Demirkapi has been building ways to tap into huge data sources, which are often overlooked by researchers, to find masses of security problems. This includes automatically finding developer secrets—such as passwords, API keys, and authentication tokens—that could give cybercriminals access to company systems and the ability to steal data.

    Today, at the Defcon security conference in Las Vegas, Demirkapi is unveiling the results of this work, detailing a massive trove of leaked secrets and wider website vulnerabilities. Among at least 15,000 developer secrets hard-coded into software, he found hundreds of username and password details linked to Nebraska’s Supreme Court and its IT systems; the details needed to access Stanford University’s Slack channels; and more than a thousand API keys belonging to OpenAI customers.

    A major smartphone manufacturer, customers of a fintech company, and a multibillion-dollar cybersecurity company are counted among the thousands of organizations that inadvertently exposed secrets. As part of his efforts to stem the tide, Demirkapi hacked together a way to automatically get the details revoked, making them useless to any hackers.

    In a second strand to the research, Demirkapi also scanned data sources to find 66,000 websites with dangling subdomain issues, making them vulnerable to various attacks including hijacking. Some of the world’s biggest websites, including a development domain owned by The New York Times, had the weaknesses.

    While the two security issues he looked into are well-known among researchers, Demirkapi says that turning to unconventional datasets, which are usually reserved for other purposes, allowed thousands of issues to be identified en masse and, if expanded, offers the potential to help protect the web at large. “The goal has been to find ways to discover trivial vulnerability classes at scale,” Demirkapi tells WIRED. “I think that there’s a gap for creative solutions.”

    Spilled Secrets; Vulnerable Websites

    It is relatively trivial for a developer to accidentally include their company’s secrets in software or code. Alon Schindel, the vice president of AI and threat research at the cloud security company Wiz, says there’s a huge variety of secrets that developers can inadvertently hard-code, or expose, throughout the software development pipeline. These can include passwords, encryption keys, API access tokens, cloud provider secrets, and TLS certificates.

    “The most acute risk of leaving secrets hard-coded is that if digital authentication credentials and secrets are exposed, they can grant adversaries unauthorized access to a company’s code bases, databases, and other sensitive digital infrastructure,” Schindel says.

    The risks are high: Exposed secrets can result in data breaches, hackers breaking into networks, and supply chain attacks, Schindel adds. Previous research in 2019 found thousands of secrets were being leaked on GitHub every day. And while various secret scanning tools exist, these largely are focused on specific targets and not the wider web, Demirkapi says.

    During his research, Demirkapi, who first found prominence for his teenage school-hacking exploits five years ago, hunted for these secret keys at scale—as opposed to selecting a company and looking specifically for its secrets. To do this, he turned to VirusTotal, the Google-owned website, which allows developers to upload files—such as apps—and have them scanned for potential malware.

    Matt Burgess

    Source link

  • Google Researchers Found Nearly a Dozen Flaws in Popular Qualcomm Software for Mobile GPUs

    Google Researchers Found Nearly a Dozen Flaws in Popular Qualcomm Software for Mobile GPUs

    Demand for graphics processing units or GPUs has exploded in recent years as video rendering and artificial intelligence systems have expanded the need for processing power. And while most of the most visible shortages (and soaring stock prices) relate to top-tier PC and server chips, mobile graphics processors are the version that everyone with a smartphone is using everyday. So vulnerabilities in these chips or how they’re implemented can have real-world consequences. That’s exactly why Google’s Android vulnerability hunting red team set its sights on open-source software from the chip giant Qualcomm that’s widely used to implement mobile GPUs.

    At the Defcon security conference in Las Vegas on Friday, three Google researchers presented more than nine vulnerabilities—now patched—that they discovered in Qualcomm’s Adreno GPU, a suite of software used to coordinate between GPUs and an operating system like Android on Qualcomm-powered phones. Such “drivers” are crucial to how any computer is designed and have deep privileges in the kernel of an operating system to coordinate between hardware peripherals and software. Attackers could exploit the flaws the researchers found to take full control of a device.

    For years, engineers and attackers alike have been most focused on potential vulnerabilities in a computer’s central processing unit (CPU) and have optimized for efficiency on GPUs, leaning on them for raw processing power. But as GPUs become more central to everything a device does all the time, hackers on both ends of the spectrum are looking at how GPU infrastructure could be exploited.

    “We are a small team compared to the big Android ecosystem—the scope is too big for us to cover everything, so we have to figure out what will have the most impact,” says Xuan Xing, manager of Google’s Android Red Team. “So why did we focus on a GPU driver for this case? It’s because there’s no permission required for untrusted apps to access GPU drivers. This is very important, and I think will attract lots of attackers’ attention.”

    Xing is referring to the fact that applications on Android phones can talk to the Adreno GPU driver directly with “no sandboxing, no additional permission checks,” as he puts it. This doesn’t in itself give applications the ability to go rogue, but it does make GPU drivers a bridge between the regular parts of the operating system (where data and access are carefully controlled), and the system kernel, which has full control over the entire device including its memory. “GPU drivers have all sorts of powerful functions,” Xing says. “That mapping in memory is a powerful primitive attackers want to have.”

    The researchers say the vulnerabilities they uncovered are all flaws that come out of the intricacies and complicated interconnections that GPU drivers must navigate to coordinate everything. To exploit the flaws, attackers would need to first establish access to a target device, perhaps by tricking victims into side-loading malicious apps.

    “There are a lot of moving parts and no access restrictions, so GPU drivers are readily accessible to pretty much every application,” says Eugene Rodionov, technical leader of the Android Red Team. “What really makes things problematic here is complexity of the implementation—that is one item which accounts for a number of vulnerabilities.”

    Qualcomm released patches for the flaws to “original equipment manufacturers” (OEMs) that use Qualcomm chips and software in the Android phones they make. “Regarding the GPU issues disclosed by Android Security Red Team, patches were made available to OEMs in May 2024,” a Qualcomm Spokesperson tells WIRED. “We encourage end users to apply security updates from device makers as they become available.”

    The Android ecosystem is complex, and patches must move from a vendor like Qualcomm to OEMs and then get packaged by each individual device maker and delivered to users’ phones. This trickle-down process sometimes means that devices can be left exposed, but Google has spent years investing to improve these pipelines and streamline communication.

    Still, the findings are yet another reminder that GPUs themselves and the software supporting them have the potential to become a critical battleground in computer security.

    As Rodionov puts it, “combining high complexity of the implementation with wide accessibility makes it a very interesting target for attackers.”

    Lily Hay Newman

    Source link

  • Flaws in Ubiquitous ATM Software Could Have Let Attackers Take Over Cash Machines

    Flaws in Ubiquitous ATM Software Could Have Let Attackers Take Over Cash Machines

    There is a grand tradition at the annual Defcon security conference in Las Vegas of hacking ATMs. Unlocking them with safecracking techniques, rigging them to steal users’ personal data and PINs, crafting and refining ATM malware and, of course, hacking them to spit out all their cash. Many of these projects targeted what are known as retail ATMs, freestanding devices like those you’d find at a gas station or a bar. But on Friday, independent researcher Matt Burch is presenting findings related to the “financial” or “enterprise” ATMs used in banks and other large institutions.

    Burch is demonstrating six vulnerabilities in ATM-maker Diebold Nixdorf’s widely deployed security solution, known as Vynamic Security Suite (VSS). The vulnerabilities, which the company says have all been patched, could be exploited by attackers to bypass an unpatched ATM’s hard drive encryption and take full control of the machine. And while there are fixes available for the bugs, Burch warns that, in practice, the patches may not be widely deployed, potentially leaving some ATMs and cash-out systems exposed.

    “Vynamic Security Suite does a number of things—it has endpoint protection, USB filtering, delegated access, and much more,” Burch tells WIRED. “But the specific attack surface that I’m taking advantage of is the hard drive encryption module. And there are six vulnerabilities, because I would identify a path and files to exploit, and then I would report it to Diebold, they would patch that issue, and then I would find another way to achieve the same outcome. They’re relatively simplistic attacks.”

    The vulnerabilities Burch found are all in VSS’s functionality to turn on disk encryption for ATM hard drives. Burch says that most ATM manufacturers rely on Microsoft’s BitLlocker Windows encryption for this purpose, but Diebold Nixdorf’s VSS uses a third-party integration to run an integrity check. The system is set up in a dual-boot configuration that has both Linux and Windows partitions. Before the operating system boots, the Linux partition runs a signature integrity check to validate that the ATM hasn’t been compromised, and then boots it into Windows for normal operation.

    “The problem is, in order to do all of that, they decrypt the system, which opens up the opportunity,” Burch says. “The core deficiency that I’m exploiting is that the Linux partition was not encrypted.”

    Burch found that he could manipulate the location of critical system validation files to redirect code execution; in other words, grant himself control of the ATM.

    Diebold Nixdorf spokesperson Michael Jacobsen tells WIRED that Burch first disclosed the findings to them in 2022 and that the company has been in touch with Burch about his Defcon talk. The company says that the vulnerabilities Burch is presenting were all addressed with patches in 2022. Burch notes, though, that as he went back to the company with new versions of the vulnerabilities over the past couple of years, his understanding is that the company continued to address some of the findings with patches in 2023. And Burch adds that he believes Diebold Nixdorf addressed the vulnerabilities on a more fundamental level in April with VSS version 4.4 that encrypts the Linux partition.

    Lily Hay Newman

    Source link

  • USPS Text Scammers Duped His Wife, So He Hacked Their Operation

    USPS Text Scammers Duped His Wife, So He Hacked Their Operation

    Smith trawled Reddit and other online sources to find people reporting the scam and find URLs being used, which he subsequently published. Some of the websites running the Smishing Triad’s tools were collecting thousands of people’s personal information per day, Smith says. Among other details, the websites would request people’s names, addresses, payment card numbers and security codes, phone numbers, dates of birth, and bank websites. This level of information can allow a scammer to make purchases online with the credit cards. Smith says his wife quickly canceled her card, but noticed that the scammers still tried to use it, for instance with Uber. The researcher says he would collect data from a website and return to it a few hours later, only to find hundreds of new records.

    The researcher provided the details to a bank that had contacted him after seeing his initial blog posts. Smith declined to name the bank. He also reported the incidents to the FBI and later provided information to the United States Postal Inspection Service (USPIS).

    Michael Martel, a national public information officer at the USPIS, says the information provided by Smith is being used as part of an ongoing USPIS investigation and that the agency cannot comment on specific details. “USPIS is already actively pursuing this type of information to protect the American people, identify victims, and serve justice to the malicious actors behind it all,” Martel says, pointing to advice on spotting and reporting USPS package delivery scams.

    Initially, Smith says, he was wary about going public with his research as this kind of “hacking back” falls into a “gray area”: It may be breaking the Computer Fraud and Abuse Act, a sweeping US computer-crimes law, but he’s doing it against foreign-based criminals. Something he is definitely not the first, or last, to do.

    Multiple Prongs

    The Smishing Triad is prolific. As well as using postal services as lures their scams, the Chinese-speaking group has targeted online banking, e-commerce, and payment systems in the US, Europe, India, Pakistan, and the United Arab Emirates, according to Shawn Loveland, the chief operating officer of Resecurity, which has consistently tracked the group.

    The Smishing Triad sends between 50,000 and 100,000 messages daily, according to Resecurity’s research. Its scam messages are sent using SMS or Apple’s iMessage, the latter is encrypted. Loveland says the Triad is made up of two distinct groups—a small team led by one Chinese hacker that creates, sells, and maintains the smishing kit, and a second group of people who buy the scamming tool. (A backdoor in the kit allows the creator to access details of administrators using the kit, Smith says in a blog post.)

    “It’s very mature,” Loveland says of the operation. The group sells the scamming kit on Telegram for a $200-per month subscription, and this can be customized to show the organization the scammers are trying to impersonate. “The main actor is Chinese communicating in the Chinese language,” Loveland says. “They do not appear to be hacking Chinese language websites or users.” (In communications with the main contact on Telegram, the individual claimed to Smith that they were a computer science student.)

    The relatively low monthly subscription cost for the smishing kit means it’s highly likely, with the number of credit card details scammers are collecting, that those using it are making significant profits. Loveland says that using text messages, which immediately send people a notification, is a more direct and more successful way of phishing, compared to sending emails with malicious links included.

    As a result, smishing has been on the rise in recent years. But there are some tell-tale signs: If you receive a message from a number or email that you don’t recognize; if it contains a link to click on; and wants you to do something urgently, you should be suspicious.

    Matt Burgess

    Source link

  • A New Plan to Break the Cycle of Destructive Critical Infrastructure Hacks

    A New Plan to Break the Cycle of Destructive Critical Infrastructure Hacks

    “It’s not just that the water goes out, it’s that when the sole wastewater facility in your community is down really bad things start to happen. For example, no water means no hospital,” he says. “I really encountered a lot of this during my leadership of the Covid Task Force. There is such interdependence across the basic functions of society.”

    UnDisruptable27 will focus on interacting with communities who aren’t reached by Washington DC-based policy discussions or Information Sharing and Analysis Centers (ISACs), which are meant to represent each infrastructure sector of the US. The project aims to communicate directly with people who actually work on the ground in US critical infrastructure, and grapple together with the reality that cybersecurity-related disasters could impact their daily work.

    “There’s a data breach, you get whatever services like identity protection for some period of time, and life carries on, and people think that there’s no long-term impact,” says Megan Stifel, IST’s chief strategy officer. “There’s this expectation that it’s fine, things will just continue. So we’re very interested in getting after this issue and thinking about how do we tackle critical infrastructure security with perhaps a new approach.”

    Corman notes that even though cybersecurity incidents have become a well-known fact of life, business owners and infrastructure operators are often shaken and caught off guard when a cybersecurity incident actually affects them. Meanwhile, when government entities try to impose cybersecurity standards or become a partner on defense initiatives, communities often balk at the intrusion and perceived overreach. Last year, for example, the US Environmental Protection Agency was forced to rescind new cybersecurity guidelines for water systems after water companies and Republicans in Congress filed a lawsuit over the initiative.

    “Time and time again, trade associations or lobbyists or owners and operators have an allergic reaction to oversight and say, ‘We prefer voluntary, we’re doing fine on our own,’ ” Corman says. “And they really are trying to do the right thing. But then also time and time again, people are just shocked that disruption could happen and feel very blindsided. So you can only conclude that the people who feel the pain of our failures are not included in the conversation. They deserve to understand the risks inherent in this level of connectivity. We’ve tried a lot of things, but we have not tried just leveling with people.”

    UnDisruptable27 is launching this week for visibility among attendees at BSides as well as the other conferences, Black Hat and Defcon, that will run through Sunday in Las Vegas. Corman says that the goal is to combine the hacker mentality and, essentially, a call for volunteers with plans to work with creative collaborators on producing engaging content to fuel discourse and understanding. Information campaigns using memes and social media posts or moonshots like narrative podcasts and even reality TV are all on the table.

    “We must prioritize the security, safety, and resilience of critical infrastructure — including water, health care facilities, and utilities,” Craig Newmark, the Craigslist founder whose philanthropy is funding UnDisruptable27, told WIRED. “The urgency of this issue requires affecting human behavior through storytelling.”

    Lily Hay Newman

    Source link

  • How Infostealers Pillaged the World’s Passwords

    How Infostealers Pillaged the World’s Passwords

    These platforms take cues in how they are designed and marketed from legitimate information and ecommerce services. Many markets and forums charge a subscription fee to access the platform and then have different pricing structures for data depending on how valuable it might be. Currently, Gray says, Russian Market has so much stolen data available from infostealers that it has been charging a low flat rate, typically no more than $10, for any subset of data users want to download.

    “Organizations have become very good with their security, and people have also gotten more savvy, so they’re not the best targets now,” for traditional tailored attacks, Gray says. “So attackers need something that’s less targeted and more based on what they can make use of. Infostealers are modular and often sold on a subscription basis, and that evolution probably aligns with the rise of modern subscription services like video streaming.”

    Infostealers have been especially effective with the rise of remote work and hybrid work, as companies adapt to allowing employees to access work services from personal devices and personal accounts from work devices. This creates opportunities for infostealers to randomly compromise individuals on, say, their home computers but still end up with corporate access credentials because the person was logged into some of their work systems as well. It also makes it easier for infostealing malware to get around corporate protections, even on enterprise devices, if employees are able to have their personal email or social media accounts open.

    “I started paying attention to this once it became an enterprise problem,” Mandiant’s Carmakal says. “And particularly around 2020, because I started seeing more intrusions of enterprises first starting from compromises of home computers—through phishing of people’s Yahoo accounts, Gmail accounts, and Hotmail accounts that were totally unrelated to any enterprise targeting, but to me look very opportunistic.”

    Victoria Kivilevich, director of threat research at security firm KELA, says that in some instances criminals can use cybercrime markets to search for the domain of potential targets and see if any credentials are available. Kivilevich says the sale of infostealer data can be considered as the “supply chain” for various types of cyberattacks, including ransomware operators looking for the details of potential victims, those involved in business email compromise, and even initial access brokers who can sell the details along again to other cybercriminals.

    On various cybercrime marketplaces and Telegram, Kivilevich says, there have been more than 7,000 compromised credentials linked to Snowflake accounts being shared. In one instance, a criminal has been touting access to 41 companies from the education sector; another cybercriminal claims to be selling access to US companies with revenues between $50 million and $8 billion, according to Kivilevich’s analysis.

    “I don’t think there was one company that came to us and had zero accounts compromised by infostealer malware,” Kivilevich says of the threat that infostealer logs provide to businesses, with KELA saying infostealer-related activity jumped in 2023. Irina Nesterovsky, KELA’s chief research officer, says millions of credentials have been collected by infostealing malware in recent years. “This is a real threat,” Nesterovsky says.

    Carmakal says there are multiple steps companies and individuals can take to protect themselves from the threat of infostealers and their aftereffects, including using antivirus or EDR products to detect malicious activity. Companies should be strict on enforcing multifactor authentication across their users, he says. “We try to encourage people to not synchronize passwords on their corporate devices with their personal devices,” Carmakal adds.

    The use of infostealers has been working so well that it is all but inevitable that cybercriminals will look to replicate the success of compromise sprees like Snowflake and get creative about other enterprise software services that they can use as entry points for access to an array of different customer companies. Carmakal warns that he expects to see this result in more breaches in the coming months. “There’s no ambiguity about this,” he says. “Threat actors will start hunting for infostealer logs, and looking for other SaaS providers, similar to Snowflake, where they log in and steal data, and then extort those companies.”

    Lily Hay Newman, Matt Burgess

    Source link

  • Stop X’s Grok AI From Training on Your Tweets

    Stop X’s Grok AI From Training on Your Tweets

    The fallout from CrowdStrike’s deleterious software update came into full view this week as system administrators and IT staffers scrambled to get digital systems back online and return operations to normal. Elsewhere, the Olympics began this week, and Paris is ready with a controversial new surveillance system that hints at a future of ubiquitous CCTV camera coverage. And researchers revealed new findings this week about the innovative malware Russia used in January to sabotage a heating utility in Lviv and cut heat to 600 Ukrainian buildings at the coldest point in the year.

    The US Department of Defense has a $141 billion idea to modernize US intercontinental ballistic missiles and their silos around the country. Meanwhile, the European Commission is allocating €7.3 billion for defense research—from drones and tanks to battleships and space intelligence—over the next seven years. And hackers have established a “ghost” network to quietly spread malware on the Microsoft-owned developer platform GitHub.

    In more encouraging news, a former Google engineer has built a prototype search engine, dubbed webXray, meant to allow users to find specific privacy violations online, determine which sites are tracking you, and see where all that data goes.

    And there’s more. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

    Leaked files obtained by The Guardian reveal that the Israeli government took extraordinary measures to prevent information about the Pegasus spyware system from falling into the hands of US courts, including seizing files directly from the company to prevent legal disclosure. The spyware is the product of the Israel-based NSO Group. It allows users to infect smartphones, extract messages and photos, record calls, and secretly activate microphones. NSO Group faces legal action in the US brought by WhatsApp, which claims the company engineered Pegasus to target users of its messaging software. According to WhatsApp, more than 1,400 of its users were targeted. NSO, whose software has been allegedly tied to the harassment and murder of journalist Jamal Khashoggi, has denied any wrongdoing.

    In an effort to thwart BIOS-based threats, prompted in part by the rollout of a powerful rootkit designed by a Chinese researcher in 2007, Secure Boot became a widely adopted tool. Unfortunately, researchers at the security firm Binarly have revealed that Secure Boot is now “completely compromised” on more than 200 device models, affecting major hardware manufacturers like Dell, Acer, and Intel. The incident was the result of a weak cryptographic key used to establish trust between hardware and firmware systems. AMI, the key’s owner, says it was meant to be used for testing and should never have made its way into production.

    Following in Meta’s footsteps, Elon Musk’s X quietly adjusted its settings this week to give the company’s AI system—known as Grok—access to all of its users’ posts. There is a way to prevent Grok from ingesting your posts; however, you cannot perform this action from the mobile app. You’ll need to access X’s Settings using a desktop computer; select Privacy and Safety, then select Grok, and then uncheck the box. Or just head straight here to go directly to the right settings page. (You can also delete your conversation history with Grok, if you have one, by clicking Delete conversation history.)

    Dell Cameron, Lily Hay Newman

    Source link

  • The US Supreme Court Kneecapped US Cyber Strategy

    The US Supreme Court Kneecapped US Cyber Strategy

    The Commerce Department could hit a legal snag with its proposal to require cloud companies to verify their customers’ identities and report on their activities. The pending rule, part of an effort to clamp down on hackers’ misuse of cloud services, has drawn industry criticism for alleged overreach. A major tech trade group warned Commerce that its “proposed regulations risk exceeding the rulemaking authority granted by Congress.” (Commerce declined to comment.)

    Lawsuits could also target other regulations—including data breach reporting requirements from the Federal Trade Commission, the Federal Communications Commission, and financial regulators—that rely on laws written long before policymakers were thinking about cybersecurity.

    “A lot of the challenges where the agencies are going to be most nervous [are] when they’ve been interpreting something for 20 years or they newly have interpreted something that’s 30 years old,” says the cyber attorney.

    The White House has already faced one major setback. Last October, the Environmental Protection Agency withdrew cyber requirements for water systems that industry groups and Republican-led states had challenged in court. Opponents said the EPA had exceeded its authority in interpreting a 1974 law to require states to add cybersecurity to their water-facility inspections, a strategy that a top White House cyber official had previously praised as “a creative approach.”

    All Eyes on Congress

    The government’s cyber regulation push is likely to run headlong into a judicial morass.

    Federal judges could reach different conclusions about the same regulations, setting up appeals to regional circuit courts that have very different track records. “The judiciary itself is not a monolith,” says Geiger, of the Center for Cybersecurity Policy and Law. In addition, agencies understand cutting-edge tech issues much better than judges, who may struggle to parse the intricacies of cyber regulations.

    There is only one real solution to this problem, according to experts: If Congress wants agencies to be able to mandate cyber improvements, it will have to pass new laws empowering them to do so.

    “There is greater onus now on Congress to act decisively to help ensure protection of the critical services on which society relies,” Geiger says.

    Clarity will be key, says Jamil Jaffer, the executive director of George Mason University’s National Security Institute and a former clerk to Supreme Court Justice Neil Gorsuch. “The more specific Congress gets, the more likely I think a court is to see it the same way an agency does.”

    Congress rarely passes major legislation, especially with new regulatory powers, but cybersecurity has consistently been an exception.

    “Congress moves very, very slowly, but it’s not completely passive [on] this front,” Lilley says. “There’s a possibility that you will see meaningful cyber legislation in particular sectors if regulators are not able to move forward.”

    One major question is whether this progress will continue if Republicans seize unified control of the government in November’s elections. Lilley is optimistic, pointing to the GOP platform’s invocation of securing critical infrastructure with heightened standards as “a national priority.”

    “There’s a sense across both sides of the aisle at this point that, certainly in some of the sectors, there has been some measure of market failure,” Lilley says, “and that some measure of government action will be appropriate.”

    Regardless of who controls Capitol Hill next January, the Supreme Court just handed lawmakers a massive amount of responsibility in the fight against hackers.

    “It’s not going to be easy,” Geiger says, “but it’s time for Congress to act.”

    Eric Geller

    Source link

  • Hackers Leaking Taylor Swift Tickets? Don’t Get Your Hopes Up

    Hackers Leaking Taylor Swift Tickets? Don’t Get Your Hopes Up

    Proton, the company behind Proton Mail, launched an end-to-end encrypted alternative to Google Docs, seeking to compete with the cloud giant on privacy. We broke down how Apple is taking a similar approach with its implementation of AI, using a system it calls Private Cloud Compute in its new Apple Intelligence features.

    In other news, we dug into how the US bans on TikTok and Kaspersky software, despite their national security justifications, pose a threat to internet freedom. We went inside a crash course for US diplomats on cybersecurity, privacy, surveillance, and other digital threats. And we published an in-depth investigation into the origins of the world’s most popular 3D-printed gun, which revealed that its creator was a self-described “incel” with fantasies of right-wing terror.

    But that’s not all. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

    The giant hack against Ticketmaster may have taken another twist. In June, criminal hackers claimed they had stolen 560 million people’s information from the ticketing company owned by Live Nation. The company has since confirmed a breach, saying its information was taken from its Snowflake account. (More than 165 Snowflake customers were impacted by attacks on the cloud storage company that exploited a lack of multi-factor authentication and stolen login details).

    Now in a post on cybercrime marketplace BreachForums, a hacker going by the name of Sp1d3rHunters is threatening to publish more data from Ticketmaster. The account claims to be sharing 170,000 ticket barcodes for upcoming Taylor Swift gigs in the US during October and November. The hacker demanded Ticketmaster “pay us $2million USD” or it will leak “680 million” users’ information and publish millions more event barcodes, including for concerts by artists such as Pink and Sting, and sporting events such as NFL games and F1 races.

    The claims appear to be dubious, however, as Ticketmaster’s barcodes aren’t static, according to the company. “Ticketmaster’s SafeTix technology protects tickets by automatically refreshing a new and unique barcode every few seconds so it cannot be stolen or copied,” a Ticketmaster spokesperson tells WIRED in a statement. The spokesperson adds that the company has not paid any ransom or engaged with the hackers’ demands.

    Hacker groups are known to lie, exaggerate, and overinflate their claims as they try to get victims to pay. The 680 million customers that Sp1d3rHunters claimed to have data on is higher than the original figure provided when the Ticketmaster breach was first claimed, and neither number has been confirmed. Even if victims do decide to pay, hackers can still keep the data and try to extort companies for a second time.

    Despite the breach at Ticketmaster originally being publicized in June, the company has only recently begun emailing customers alerting them to the incident, which happened between April 2 and May 18 this year. The company says the database accessed may include emails, phone numbers, encrypted credit card information, and other personal information.

    In recent years, there’s been a sharp uptick in cybercriminals deploying infostealers. This malware can grab all of the login and financial details that someone enters on their machine, which hackers then sell to others who want to exploit the information.

    Cybersecurity researchers at Recorded Future have now published proof-of-concept findings showing these stolen login details can be used to potentially track down people visiting dark-web child sexual abuse material (CSAM) sites. Within infostealer logs, the researchers say they were able to find thousands of login details for known CSAM websites, which they could then cross-reference with other details and identify the potential real-world names connected to the abusive website logins. The researchers reported details of individuals to law enforcement.

    Matt Burgess, Andy Greenberg

    Source link

  • Government says Veterans Affairs and State Departments were swept up in Russian-backed Microsoft hack

    Government says Veterans Affairs and State Departments were swept up in Russian-backed Microsoft hack

    The US Department of Veterans Affairs and an arm of the US State Department are among a growing list of Microsoft Corp. customers that have acknowledged they were impacted by a breach of the technology giant that was blamed on Russian state-sponsored hackers.

    The US Agency for Global Media, part of the State Department that provides news and information in countries where the press is restricted, was notified “a couple months ago” by Microsoft that some of its data may have been stolen, a spokesperson said in an emailed statement. No security or personally identifiable sensitive data was compromised, the spokesperson said.

    The agency is working closely with the Department of Homeland Security on the incident, the spokesperson said, declining to answer additional questions. A State Department spokesperson said, “We are aware that Microsoft is reaching out to agencies, both affected and unaffected, in the spirit of transparency.”

    Microsoft disclosed in January that a Russian hacking group it calls Midnight Blizzard had accessed corporate email accounts and later warned that they were attempting to use secrets shared between the technology giant and its customers. The company has declined to identify the customers who were impacted.

    “As our investigation continues, we have been reaching out to customers to notify them if they had corresponded with a Microsoft corporate email account that was accessed,” a Microsoft spokesperson said on Wednesday. “We will continue to coordinate, support and assist our customers in taking mitigating measures.”

    In addition, the Department of Veterans Affairs was notified in March that it was impacted the Microsoft breach, officials for the agency said.

    A one-second intrusion

    The hackers used a single set of stolen credentials — found in the emails they accessed — to break into a test environment in the VA’s Microsoft Cloud account around January, the officials said, adding that the intrusion lasted for one second. Midnight Blizzard likely intended to check if the credentials were valid, presumably with the larger intention of breaching the VA’s network, the officials said. 

    The agency changed the exposed credentials, along with log-in details across their Microsoft environments, once they were notified of the intrusion, they said. After reviewing the emails that the hackers accessed, the VA determined that no additional credentials or sensitive email was taken, the officials said.

    Terrence Hayes, the VA’s press secretary, said an investigation is continuing to determine any additional impact.

    The Peace Corps was also contacted by Microsoft and notified about the Midnight Blizzard breach, according to a statement from its press office. “Based on this notification, Peace Corps technical staff were able to mitigate the vulnerability,” according to the agency. The Peace Corps declined further comment.

    Bloomberg News asked other federal agencies for comment, and none of the others disclosed that they were impacted by Midnight Blizzard’s attack on Microsoft. Bloomberg previously reported that more than a dozen Texas state agencies and public universities were exposed by the Russian hack.

    Midnight Blizzard, also known in cybersecurity circles as “Cozy Bear” and “APT29,” is part of Russia’s foreign intelligence service, according to US and UK authorities. 

    In April, US federal agencies were ordered to analyze emails, reset compromise passwords and work to secure Microsoft cloud accounts amid fears that Midnight Blizzard may have accessed correspondence. Microsoft has been notifying some customers in the months since then that their emails with the tech giant were accessed by the Russian hackers.

    The Midnight Blizzard breach was one in a series of high-profile and damaging security failures at the Redmond, Washington-based technology company, which has drawn strong condemnation by the US government. Microsoft President Brad Smith appeared before Congress last month where he acknowledged security failures and vowed to improve the company’s operations. 

    Charles Gorrivan, Jamie Tarabay, Evan Gorelick, Bloomberg

    Source link