ReportWire

Tag: Hacking

  • Hackers Leaking Taylor Swift Tickets? Don’t Get Your Hopes Up

    Hackers Leaking Taylor Swift Tickets? Don’t Get Your Hopes Up

    [ad_1]

    Proton, the company behind Proton Mail, launched an end-to-end encrypted alternative to Google Docs, seeking to compete with the cloud giant on privacy. We broke down how Apple is taking a similar approach with its implementation of AI, using a system it calls Private Cloud Compute in its new Apple Intelligence features.

    In other news, we dug into how the US bans on TikTok and Kaspersky software, despite their national security justifications, pose a threat to internet freedom. We went inside a crash course for US diplomats on cybersecurity, privacy, surveillance, and other digital threats. And we published an in-depth investigation into the origins of the world’s most popular 3D-printed gun, which revealed that its creator was a self-described “incel” with fantasies of right-wing terror.

    But that’s not all. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

    The giant hack against Ticketmaster may have taken another twist. In June, criminal hackers claimed they had stolen 560 million people’s information from the ticketing company owned by Live Nation. The company has since confirmed a breach, saying its information was taken from its Snowflake account. (More than 165 Snowflake customers were impacted by attacks on the cloud storage company that exploited a lack of multi-factor authentication and stolen login details).

    Now in a post on cybercrime marketplace BreachForums, a hacker going by the name of Sp1d3rHunters is threatening to publish more data from Ticketmaster. The account claims to be sharing 170,000 ticket barcodes for upcoming Taylor Swift gigs in the US during October and November. The hacker demanded Ticketmaster “pay us $2million USD” or it will leak “680 million” users’ information and publish millions more event barcodes, including for concerts by artists such as Pink and Sting, and sporting events such as NFL games and F1 races.

    The claims appear to be dubious, however, as Ticketmaster’s barcodes aren’t static, according to the company. “Ticketmaster’s SafeTix technology protects tickets by automatically refreshing a new and unique barcode every few seconds so it cannot be stolen or copied,” a Ticketmaster spokesperson tells WIRED in a statement. The spokesperson adds that the company has not paid any ransom or engaged with the hackers’ demands.

    Hacker groups are known to lie, exaggerate, and overinflate their claims as they try to get victims to pay. The 680 million customers that Sp1d3rHunters claimed to have data on is higher than the original figure provided when the Ticketmaster breach was first claimed, and neither number has been confirmed. Even if victims do decide to pay, hackers can still keep the data and try to extort companies for a second time.

    Despite the breach at Ticketmaster originally being publicized in June, the company has only recently begun emailing customers alerting them to the incident, which happened between April 2 and May 18 this year. The company says the database accessed may include emails, phone numbers, encrypted credit card information, and other personal information.

    In recent years, there’s been a sharp uptick in cybercriminals deploying infostealers. This malware can grab all of the login and financial details that someone enters on their machine, which hackers then sell to others who want to exploit the information.

    Cybersecurity researchers at Recorded Future have now published proof-of-concept findings showing these stolen login details can be used to potentially track down people visiting dark-web child sexual abuse material (CSAM) sites. Within infostealer logs, the researchers say they were able to find thousands of login details for known CSAM websites, which they could then cross-reference with other details and identify the potential real-world names connected to the abusive website logins. The researchers reported details of individuals to law enforcement.

    [ad_2]

    Matt Burgess, Andy Greenberg

    Source link

  • Government says Veterans Affairs and State Departments were swept up in Russian-backed Microsoft hack

    Government says Veterans Affairs and State Departments were swept up in Russian-backed Microsoft hack

    [ad_1]

    The US Department of Veterans Affairs and an arm of the US State Department are among a growing list of Microsoft Corp. customers that have acknowledged they were impacted by a breach of the technology giant that was blamed on Russian state-sponsored hackers.

    The US Agency for Global Media, part of the State Department that provides news and information in countries where the press is restricted, was notified “a couple months ago” by Microsoft that some of its data may have been stolen, a spokesperson said in an emailed statement. No security or personally identifiable sensitive data was compromised, the spokesperson said.

    The agency is working closely with the Department of Homeland Security on the incident, the spokesperson said, declining to answer additional questions. A State Department spokesperson said, “We are aware that Microsoft is reaching out to agencies, both affected and unaffected, in the spirit of transparency.”

    Microsoft disclosed in January that a Russian hacking group it calls Midnight Blizzard had accessed corporate email accounts and later warned that they were attempting to use secrets shared between the technology giant and its customers. The company has declined to identify the customers who were impacted.

    “As our investigation continues, we have been reaching out to customers to notify them if they had corresponded with a Microsoft corporate email account that was accessed,” a Microsoft spokesperson said on Wednesday. “We will continue to coordinate, support and assist our customers in taking mitigating measures.”

    In addition, the Department of Veterans Affairs was notified in March that it was impacted the Microsoft breach, officials for the agency said.

    A one-second intrusion

    The hackers used a single set of stolen credentials — found in the emails they accessed — to break into a test environment in the VA’s Microsoft Cloud account around January, the officials said, adding that the intrusion lasted for one second. Midnight Blizzard likely intended to check if the credentials were valid, presumably with the larger intention of breaching the VA’s network, the officials said. 

    The agency changed the exposed credentials, along with log-in details across their Microsoft environments, once they were notified of the intrusion, they said. After reviewing the emails that the hackers accessed, the VA determined that no additional credentials or sensitive email was taken, the officials said.

    Terrence Hayes, the VA’s press secretary, said an investigation is continuing to determine any additional impact.

    The Peace Corps was also contacted by Microsoft and notified about the Midnight Blizzard breach, according to a statement from its press office. “Based on this notification, Peace Corps technical staff were able to mitigate the vulnerability,” according to the agency. The Peace Corps declined further comment.

    Bloomberg News asked other federal agencies for comment, and none of the others disclosed that they were impacted by Midnight Blizzard’s attack on Microsoft. Bloomberg previously reported that more than a dozen Texas state agencies and public universities were exposed by the Russian hack.

    Midnight Blizzard, also known in cybersecurity circles as “Cozy Bear” and “APT29,” is part of Russia’s foreign intelligence service, according to US and UK authorities. 

    In April, US federal agencies were ordered to analyze emails, reset compromise passwords and work to secure Microsoft cloud accounts amid fears that Midnight Blizzard may have accessed correspondence. Microsoft has been notifying some customers in the months since then that their emails with the tech giant were accessed by the Russian hackers.

    The Midnight Blizzard breach was one in a series of high-profile and damaging security failures at the Redmond, Washington-based technology company, which has drawn strong condemnation by the US government. Microsoft President Brad Smith appeared before Congress last month where he acknowledged security failures and vowed to improve the company’s operations. 

    [ad_2]

    Charles Gorrivan, Jamie Tarabay, Evan Gorelick, Bloomberg

    Source link

  • US National Security Experts Warn AI Giants Aren’t Doing Enough to Protect Their Secrets

    US National Security Experts Warn AI Giants Aren’t Doing Enough to Protect Their Secrets

    [ad_1]

    Google, in public comments to the NTIA ahead of its report, said it expects “to see increased attempts to disrupt, degrade, deceive, and steal” models. But it added that its secrets are guarded by a “security, safety, and reliability organization consisting of engineers and researchers with world-class expertise” and that it was working on “a framework” that would involve an expert committee to help govern access to models and their weights.

    Like Google, OpenAI said in comments to the NTIA that there was a need for both open and closed models, depending on the circumstances. OpenAI, which develops models such as GPT-4 and the services and apps that build on them, like ChatGPT, last week formed its own security committee on its board and this week published details on its blog about the security of the technology it uses to train models. The blog post expressed hope that the transparency would inspire other labs to adopt protective measures. It didn’t specify from whom the secrets needed protecting.

    Speaking alongside Rice at Stanford, RAND CEO Jason Matheny echoed her concerns about security gaps. By using export controls to limit China’s access to powerful computer chips, the US has hampered Chinese developers’ ability to develop their own models, Matheny said. He claimed that has increased their need to steal AI software outright.

    By Matheny’s estimate, spending a few million dollars on a cyberattack that steals AI model weights, which might cost an American company hundreds of billions of dollars to create, is well worth it for China. “It’s really hard, and it’s really important, and we’re not investing enough nationally to get that right,” Matheny said.

    China’s embassy in Washington, DC, did not immediately respond to WIRED’s request for comment on theft accusations, but in the past has described such claims as baseless smears by Western officials.

    Google has said that it tipped off law enforcement about the incident that became the US case alleging theft of AI chip secrets for China. While the company has described maintaining strict safeguards to prevent the theft of its proprietary data, court papers show it took considerable time for Google to catch the defendant, Linwei Ding, a Chinese national who has pleaded not guilty to the federal charges.

    The engineer, who also goes by Leon, was hired in 2019 to work on software for Google’s supercomputing data centers, according to prosecutors. Over about a year starting in 2022, he allegedly copied more than 500 files with confidential information over to his personal Google account. The scheme worked in part, court papers say, by the employee pasting information into Apple’s Notes app on his company laptop, converting the files to PDFs, and uploading them elsewhere, all the while evading Google’s technology meant to catch that sort of exfiltration.

    While engaged in the alleged stealing, the US claims the employee was in touch with the CEO of an AI startup in China and had moved to start his own Chinese AI company. If convicted, he faces up to 10 years in prison.

    [ad_2]

    Paresh Dave

    Source link

  • Hacked, leaked, exposed: Why you should never use stalkerware apps | TechCrunch

    Hacked, leaked, exposed: Why you should never use stalkerware apps | TechCrunch

    [ad_1]

    Last week, an unknown hacker broke into the servers of the U.S.-based stalkerware maker pcTattletale. The hacker then stole and leaked the company’s internal data. They also defaced pcTattletale’s official website with the goal of embarrassing the company. 

    “This took a total of 15 minutes from reading the techcrunch article,” the hackers wrote in the defacement, referring to a recent TechCrunch article where we reported that pcTattletale was used to monitor several front desk check-in computers at Wyndham hotels across the United States.

    As a result of this hack, leak and shame operation, pcTattletale founder Bryan Fleming said he was shutting down his company.

    Consumer spyware apps like pcTattletale are commonly referred to as stalkerware because jealous spouses and partners use them to surreptitiously monitor and surveil their loved ones. These companies often explicitly market their products as solutions to catch cheating partners by encouraging illegal and unethical behavior. And there have been multiple court cases, journalistic investigations, and surveys of domestic abuse shelters that show that online stalking and monitoring can lead to cases of real-world harm and violence. 

    And that’s why hackers have repeatedly targeted some of these companies.

    According to TechCrunch’s tally, with this latest hack, pcTattletale has become the 20th stalkerware company since 2017 that is known to have been hacked or leaked customer and victims’ data online. That’s not a typo: Twenty stalkerware companies have either been hacked or had a significant data exposure in recent years. And three stalkerware companies were hacked multiple times. 

    Eva Galerpin, the director of cybersecurity at the Electronic Frontier Foundation and a leading researcher and activist who has investigated and fought stalkerware for years, said the stalkerware industry is a “soft target.” “The people who run these companies are perhaps not the most scrupulous or really concerned about the quality of their product,” Galperin told TechCrunch.

    Given the history of stalkerware compromises, that may be an understatement. And because of the lack of care for protecting their own customers — and consequently the personal data of tens of thousands of unwitting victims — using these apps is doubly irresponsible. The stalkerware customers may be breaking the law, abusing their partners by illegally spying on them, and, on top of that, putting everyone’s data in danger. 

    A history of stalkerware hacks

    The flurry of stalkerware breaches began in 2017 when a group of hackers breached the U.S.-based Retina-X and the Thailand-based FlexiSpy back to back. Those two hacks revealed that the companies had a total number of 130,000 customers all over the world.

    At the time, the hackers who — proudly — claimed responsibility for the compromises explicitly said their motivations were to expose and hopefully help destroy an industry that they consider toxic and unethical.

    “I’m going to burn them to the ground, and leave absolutely nowhere for any of them to hide,” one of the hackers involved then told Motherboard. 

    Referring to FlexiSpy, the hacker added: “I hope they’ll fall apart and fail as a company, and have some time to reflect on what they did. However, I fear they might try and give birth to themselves again in a new form. But if they do, I’ll be there.”

    Despite the hack, and years of negative public attention, FlexiSpy is still active today. The same cannot be said about Retina-X.

    The hacker who broke into Retina-X wiped its servers with the goal of hampering its operations. The company bounced back — and then it got hacked again a year later. A couple of weeks after the second breach, Retina-X announced that it was shutting down. 

    Just days after the second Retina-X breach, hackers hit Mobistealth and Spy Master Pro, stealing gigabytes of customer and business records, as well as victims’ intercepted messages and precise GPS locations. Another stalkerware vendor, the India-based SpyHuman, encountered the same fate a few months later, with hackers stealing text messages and call metadata, which contained logs of who called who and when. 

    Weeks later, there was the first case of accidental data exposure, rather than a hack. SpyFone left an Amazon-hosted S3 storage bucket unprotected online, which meant anyone could see and download text messages, photos, audio recordings, contacts, location, scrambled passwords and login information, Facebook messages and more. All that data was stolen from victims, most of whom did not know they were being spied on, let alone know their most sensitive personal data was also on the internet for all to see. 

    Other stalkerware companies that over the years have irresponsibly left customer and victims’ data online are FamilyOrbit, which left 281 gigabytes of personal data online protected only by an easy-to-find password; mSpy, which leaked over 2 million customer records; Xnore, which let any of its customers see the personal data of other customers’ targets, which included chat messages, GPS coordinates, emails, photos and more; Mobiispy, which left 25,000 audio recordings and 95,000 images on a server accessible to anyone; KidsGuard, which had a misconfigured server that leaked victims’ content; pcTattletale, which prior to its hack also exposed screenshots of victims’ devices uploaded in real-time to a website that anyone could access; and Xnspy, whose developers left credentials and private keys left in the apps’ code, allowing anyone to access victims’ data.

    As far as other stalkerware companies that actually got hacked, there was Copy9, which saw a hacker steal the data of all its surveillance targets, including text messages and WhatsApp messages, call recordings, photos, contacts, and brows history; LetMeSpy, which shut down after hackers breached and wiped its servers; the Brazil-based WebDetetive, which also got its servers wiped, and then hacked again; OwnSpy, which provides much of the backend software for WebDetetive, also got hacked; Spyhide, which had a vulnerability in its code that allowed a hacker to access the back-end databases and years of stolen around 60,000 victims’ data; and Oospy, which was a rebrand of Spyhide, shut down for a second time.

    Finally there is TheTruthSpy, a network of stalkerware apps, which holds the dubious record of having been hacked or having leaked data on at least three separate occasions. 

    Hacked, but unrepented

    Of these 20 stalkerware companies, eight have shut down, according to TechCrunch’s tally. 

    In a first and so far unique case, the Federal Trade Commission banned SpyFone and its chief executive, Scott Zuckerman, from operating in the surveillance industry following an earlier security lapse that exposed victims’ data. Another stalkerware operation linked to Zuckerman, called SpyTrac, subsequently shut down following a TechCrunch investigation. 

    PhoneSpector and Highster, another two companies that are not known to have been hacked, also shut down after New York’s attorney general accused the companies of explicitly encouraging customers to use their software for illegal surveillance. 

    But a company closing doesn’t mean it’s gone forever. As with Spyhide and SpyFone, some of the same owners and developers behind a shuttered stalkerware maker simply rebranded. 

    “I do think that these hacks do things. They do accomplish things, they do put a dent in it,” Galperin said. “But if you think that if you hack a stalkerware company, that they will simply shake their fists, curse your name, disappear in a puff of blue smoke and never be seen again, that has most definitely not been the case.”

    “What happens most often, when you actually manage to kill a stalkerware company, is that the stalkerware company comes up like mushrooms after the rain,” Galperin added. 

    There is some good news. In a report last year, security firm Malwarebytes said that the use of stalkerware is declining, according to its own data of customers infected with this type of software. Also, Galperin reports seeing an increase in negative reviews of these apps, with customers or prospective customers complaining they don’t work as intended.

    But, Galperin said that it’s possible that security firms aren’t as good at detecting stalkerware as they used to be, or stalkers have moved from software-based surveillance to physical surveillance enabled by AirTags and other Bluetooth-enabled trackers.

    “Stalkerware does not exist in a vacuum. Stalkerware is part of a whole world of tech enabled abuse,” Galperin said.

    Say no to stalkerware

    Using spyware to monitor your loved ones is not only unethical, it’s also illegal in most jurisdictions, as it’s considered unlawful surveillance. 

    That is already a significant reason not to use stalkerware. Then there is the issue that stalkerware makers have proven time and time again that they cannot keep data secure — neither data belonging to the customers nor their victims or targets.

    Apart from spying on romantic partners and spouses, some people use stalkerware apps to monitor their children. While this type of use, at least in the United States, is legal, it doesn’t mean using stalkerware to snoop on your kids’ phone isn’t creepy and unethical. 

    Even if it’s lawful, Galperin thinks parents should not spy on their children without telling them, and without their consent. 

    If parents do inform their children and get their go-ahead, parents should stay away from insecure and untrustworthy stalkerware apps, and use parental tracking tools built into Apple phones and tablets and Android devices that are safer and operate overtly. 

    If you or someone you know needs help, the National Domestic Violence Hotline (1-800-799-7233) provides 24/7 free, confidential support to victims of domestic abuse and violence. If you are in an emergency situation, call 911. The Coalition Against Stalkerware has resources if you think your phone has been compromised by spyware.

    [ad_2]

    Lorenzo Franceschi-Bicchierai

    Source link

  • DOJ charges Chinese national with operating ‘world’s largest botnet’ that stole $5.9 billion in Covid relief funds

    DOJ charges Chinese national with operating ‘world’s largest botnet’ that stole $5.9 billion in Covid relief funds

    [ad_1]

    The seal of the US Department of Justice in Washington, DC on March 21, 2024. 

    Mandel Ngan | Afp | Getty Images

    A global malware network responsible for the theft of $5.9 billion in Covid relief funds and tied to other crimes like child exploitation and bomb threats has been shut down, Department of Justice officials announced Wednesday.

    The DOJ arrested 35-year-old YunHe Wang, a Chinese national who was charged with creating the “botnet,” a kind of malware that connects a network of hacked devices, which criminals can then use remotely to launch cyberattacks.

    Federal Bureau of Investigation Director Christopher Wray said it is “likely the world’s largest botnet ever.”

    From 2014 to 2022, Wang launched and operated the botnet, called “911 S5,” from roughly 150 servers worldwide, including some in the U.S., according to the indictment. 911 S5 hacked into over 19 million IP addresses in nearly 200 countries, about 614,000 of which were in the U.S., according to the DOJ.

    The FBI released a how-to guide for users to identify if their devices had been targets of a 911 S5 attack and if so, how to remove the malware.

    Wang allegedly sold access to the compromised IP addresses to cybercriminals and amassed at least $99 million, which he used to buy luxury cars, watches and property around the world.

    911 S5 was also used for fraud, stalking, harassment, illegal exportation of goods and other crimes, the DOJ said. In particular, the botnet targeted Covid relief programs and filed an estimated 560,000 false unemployment insurance claims, stealing $5.9 billion.

    “The conduct alleged here reads like it’s ripped from a screenplay,” said Assistant Secretary for Export Enforcement Matthew S. Axelrod of the U.S. Department of Commerce’s Bureau of Industry and Security.

    “What they don’t show in the movies though is the painstaking work it takes by domestic and international law enforcement, working closely with industry partners, to take down such a brazen scheme and make an arrest like this happen,” Axelrod added in his statement.

    The DOJ partnered with the FBI and other law enforcement agencies internationally to dismantle the botnet and arrest Wang.

    The arrest comes a day after Treasury Department sanctioned Wang and two others for their alleged involvement with 911 S5. Treasury also imposed sanctions on three companies that Wang owned or controlled: Spicy Code Company Limited, Tulip Biz Pattaya Group Company Limited, and Lily Suites Company Limited.

    Wang is facing a maximum 65-year prison sentence with four criminal counts: conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud and conspiracy to commit money laundering. 

    The charges come as U.S. law enforcement agencies try to update protocols to keep up with more sophisticated cybersecurity threats.

    In recent years, the U.S. has expressed particular concern for China-backed hackers looking to subvert American infrastructure.

    In January, the FBI announced that it had dismantled the Chinese “Volt Typhoon” hacking group, which had been targeting U.S. water plants, electric grids and more.

    “Today, and literally every day, they’re actively attacking our economic security, engaging in wholesale theft of our innovation, and our personal and corporate data,” Wray said at a January hearing.

    [ad_2]

    Source link

  • Microsoft’s New Recall AI Tool May Be a ‘Privacy Nightmare’

    Microsoft’s New Recall AI Tool May Be a ‘Privacy Nightmare’

    [ad_1]

    Sex, drugs, and … Eventbrite? A WIRED investigation published this week uncovered a network of spammers and scammers pushing the illegal sale of controlled substances like Xanax and oxycodone, escort services, social media accounts, and personal information on the event management platform. Making matters worse, Eventbrite’s recommendation algorithm promoted posts for opioids alongside addiction recovery events. The good news is, the company appears to have removed most of the more than 7,400 illicit posts WIRED uncovered.

    If you drive a Tesla Model 3, make sure to enable your PIN-to-drive feature or your car could be easily stolen within seconds. While the company has added new ultra-wideband radio tech to its keyless system, which can prevent “relay attacks,” researchers at Beijing-based security firm GoGoByte found that Model 3s (as well as other unnamed makes and models of vehicles) are still vulnerable. Relay attacks use inexpensive radios to transmit the signal from someone’s key fob or phone app that can then be used to unlock and start an impacted vehicle. Tesla says its adoption of ultra-wideband radio was not meant to stop relay attacks (even though it technically could), but it’s possible the automaker will add that protection in the future.

    Police busting people for running illicit online markets is nearly as old a tale as the dark web itself. But this week’s takedown offered a new twist. The FBI recently arrested Lin Rui-siang, a 23-year-old accused of operating Incognito Market, which authorities claim facilitated $100 million in sales of narcotics on the dark web. US prosecutors claim Lin then extorted Incognito’s users by threatening to expose them unless they paid up. Curiously, Lin’s professional experience includes teaching police how to catch cybercriminals by tracing cryptocurrency on blockchains. If the US Justice Department is correct about his alleged involvement in Incognito Market, that would make him one of the most unusual cybercriminals we’ve ever encountered.

    Leaks don’t just impact people on the wrong side of the law, of course. An unsecured database recently exposed biometric data of police officers in India, including face scans, fingerprints, and more. The incident reveals the dangers of collecting sensitive biometrics in the first place.

    Finally, the saga of WikiLeaks founder Julian Assange inched forward again this week, with a British court ruling that he can appeal his extradition to the US, where he faces 18 charges under the Espionage Act for WikiLeaks’ publication of classified US military information. The judges said that Assange can appeal US prosecutors’ assurances about how his trial would be conducted and on First Amendment grounds. The appeals process will inevitably push back any final decision about his potential extradition for months.

    But that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    Following the trend of tech companies in the AI race throwing privacy and caution to the wind, Microsoft unveiled plans this week to launch a tool on its forthcoming Copilot+ PCs called Recall that takes screenshots of its customers’ computers every few seconds. Microsoft says the tool is meant to give people the ability to “find the content you have viewed on your device.” The company also claims to have a range of protections in place and says the images are only stored locally in an encrypted drive, but the response has been roundly negative nonetheless, with some watchdogs reportedly calling it a possible “privacy nightmare.” The company notes that an intruder would need a password and physical access to the device to view any of the screenshots, which should rule out the possibility of anyone with legal concerns ever adopting the system. Ironically, Recall’s description sounds eerily reminiscent of computer monitoring software the FBI has used in the past. Microsoft even acknowledges that the system takes no steps to redact passwords or financial information.

    Federal authorities are reportedly working quietly to establish ties between antiwar demonstrators on US campuses and any foreign groups or individuals overseas, according to journalist Ken Klippenstein, formerly of the Intercept, who says the National Counterterrorism Center is at the center of the effort. Evidence of overseas ties would lend further ammunition to politicians, university officials, and police, who’ve widely claimed “outside agitators” are to blame for the demonstrations—an allegation that’s routinely lobbed at protesters in the United States, often meant to imply that the protesters themselves are dupes. Incidentally, authorities may also overcome constitutional hurdles to surveillance by establishing a foreign target to spy on; someone unprotected by the country’s Fourth Amendment. Republicans in Congress—representatives Mark Green and August Pfluger—have, meanwhile, asked the FBI and Department of Homeland Security to supply congressional committees with records about the government’s surveillance of the protesters, including any efforts to infiltrate them using “online covert employees or confidential human sources.”

    The FBI has nabbed a 42-year-old Wisconsin man for using Stable Diffusion, the text-to-image generative AI software, to manufacture child sexual abuse material. The man was reportedly caught with “thousands of realistic images” of children, some featuring them nude or partially clothed with men. Court records indicate the evidence includes more than 13,000 gen-AI images as well as the prompts he used to create the images. “Using AI to produce sexually explicit depictions of children is illegal, and the Justice Department will not hesitate to hold accountable those who possess, produce, or distribute AI-generated child sexual abuse material,” Nicole Argentieri, head of the Justice Department’s Criminal Division, says in a statement. The arrest is part of Project Safe Childhood, a collaboration between the government and corporations reportedly targeting online offenders.

    Security researchers this week disclosed to TechCrunch that they’d discovered consumer-grade spyware—often known as “stalkerware”—on the computers of “at least three” Wyndham hotels in the United States, potentially exposing travelers’ personal details. The stalkerware, called pcTattletale, can be installed on Android and Windows devices, giving whoever has control of the sneaky app the ability to access data on the targeted machine and monitor users’ activity. The presence of pcTattletale was discovered thanks to a security flaw in the spyware that exposed screenshots of infected machines to the open internet, according to the researchers. Although the researchers found pcTattletale on Wyndham computers, the hotel company says each of its locations are franchises, suggesting that the spyware infection could be limited to just a few locations.

    [ad_2]

    Dell Cameron, Andrew Couts

    Source link

  • Teslas Can Still Be Stolen With a Cheap Radio Hack—Despite New Keyless Tech

    Teslas Can Still Be Stolen With a Cheap Radio Hack—Despite New Keyless Tech

    [ad_1]

    In 2020, Tesla even wrote in a filing to the US Federal Communications Commission that it would be implementing ultra-wideband in its keyless entry systems, and that the ability to far more precisely measure the distance of a key fob or smartphone from a car would—or at least could—prevent its vehicles from being stolen via relay attacks. “The distance estimate is based on a Time of Flight measurement, which is immune to relay attacks,” Tesla’s filing read. That document, first turned up by the Verge, led to widespread reports and social media comments suggesting that the upcoming ultra-wideband version of Tesla’s keyless entry system would spell the end of relay attacks against its vehicles.

    Yet the GoGoByte researchers found they were able to carry out their relay attack against the latest Tesla Model 3 over Bluetooth, just as they had with earlier models, from a distance as far as 15 feet between their device and the owner’s key or phone. While the cars do appear to use ultra-wideband communications, they don’t apparently use them for a distance check to prevent keyless entry theft.

    Tesla has not yet responded to WIRED’s requests for comment.

    When the GoGoByte researchers shared their findings with Tesla earlier this month, the company’s product security team immediately responded in an email dispelling any rumor that ultra-wideband, or “UWB,” was even intended to prevent theft. “This behavior is expected, as we are currently working on improving the reliability of UWB,” read Tesla’s email in response to GoGoByte’s description of its relay attack. “UWB ranging will be enforced when reliability improvements are complete.”

    That answer shouldn’t necessarily come as a surprise, says Josep Rodriguez, a researcher for security firm IOActive who has previously demonstrated relay attacks against Tesla vehicles. Tesla never explicitly said it had started using the ultra-wideband feature for security, after all—instead, the company has touted ultra-wideband features like detecting that someone’s phone is next to the trunk to open it hands-free—and using it as a security check may still produce too many false positives.

    “My understanding is that it can take engineering teams time to find a sweet spot where relay attacks can be prevented but also not affect the user experience,” Rodriguez wrote in an email to WIRED. “I wasn’t expecting that the first implementation of UWB in vehicles would solve the relay attacks.”

    Automakers’ slow adoption of ultra-wideband security features isn’t just limited to Tesla, the GoGoByte researchers note. They found that two other carmakers whose keys support ultra-wideband communications are also still vulnerable to relay attacks. In one case, the company hadn’t even written any software to implement ultra-wideband communications in its cars’ locking systems, despite upgrading to hardware that supports it. (The researchers aren’t yet naming those other carmakers since they’re still working through the vulnerability disclosure process with them.)

    Despite Teslas’ high price tag and continuing vulnerability to relay attacks, some studies have found that the cars are far less likely to be stolen than other cars due to their default GPS tracking—though some car theft rings have targeted them anyway using relay attacks to sell the vehicles for parts.

    GoGoByte notes that Tesla, unlike many other carmakers, does have the ability to push out over-the-air updates to its cars and might still use that feature to implement a relay attack fix via ultra-wideband communications. Until then, though, the GoGoByte researchers say they want Tesla owners to understand they’re far from immune. “I think Tesla will be able to fix this because they have the hardware in place,” says Li. “But I think the public should be notified of this issue before they release the secure version.”

    Until then, in other words, keep your Tesla’s PIN-to-drive protection in place. Better that than keeping your keys and smartphone in the freezer—or waking up to find a vacant driveway and your car sold for parts.

    [ad_2]

    Andy Greenberg

    Source link

  • Microsoft Deploys Generative AI for US Spies

    Microsoft Deploys Generative AI for US Spies

    [ad_1]

    Law enforcement in the United States, United Kingdom, and Australia this week named a Russian national as the person behind LockBitSupp, the pseudonym of the leader of the LockBit ransomware gang that the US says is responsible for extracting $500 million from its victims. Dmitry Yuryevich Khoroshev has been sanctioned and charged with 26 criminal counts in the US, which combined could result in a prison sentence of 185 years. That is, if he’s ever arrested and successfully prosecuted—an extremely rare event for suspects who live in Russia.

    Elsewhere in the world of cybercrime, WIRED’s Andy Greenberg interviewed a representative of Cyber Army of Russia, a group of hackers who have targeted water utilities in the US and Europe and are said to have ties to the notorious Russian military hacking unit known as Sandworm. The responses from Cyber Army of Russia were littered with pro-Kremlin talking points—and some curious admissions.

    A deputy director of the FBI has urged the agency’s employees to continue to use a massive foreign surveillance database to search for the communications of “US persons,” sparking the ire of privacy and civil liberty advocates who unsuccessfully fought for such searches to require a warrant. Section 702 of the Foreign Intelligence Surveillance Act requires that “targets” of the surveillance program be based outside the US, but the texts, emails, and phone call of people in the US can be included in the 702 database if one of the parties involved in the communication is foreign. An amendment that would have required the FBI to obtain a warrant for 702 searches of US persons failed in a tie vote earlier this year.

    Security researchers this week revealed an attack on VPNs that forces some or all of a user’s web traffic to be routed outside the encrypted tunnel, thus negating the entire reason for using a VPN. Dubbed “TunnelVision,” the attack impacts nearly all VPN applications, and the researchers say the attack has been possible since 2022, meaning it’s possible that it’s already been used by malicious actors.

    That’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    Microsoft has developed an offline generative AI model designed specifically to handle top-secret information for US intelligence agencies, according to Bloomberg. This system, based on GPT-4, is isolated from the internet and only accessible through a network exclusive to the US government. William Chappell, Microsoft’s chief technology officer for strategic missions and technology, told Bloomberg that, theoretically, around 10,000 individuals could access the system.

    Although spy agencies are eager to leverage the capabilities of generative AI, concerns have been raised about the potential unintended leakage of classified information, as these systems typically rely on online cloud services for data processing. However, Microsoft claims that the model it created for the US government is “clean,” meaning it can read files without learning from them, preventing secret information from being integrated into the platform. Bloomberg noted that this marks the first time a major large language model has operated entirely offline.

    Sky News reported this week that Britain’s Ministry of Defence was the target of a significant cyberattack on its third-party payroll system. On Tuesday, Grant Shapps, the UK defence secretary, informed members of Parliament that payroll records of approximately 270,000 current and former military personnel, including their home addresses, had been accessed in the cyberattack. “State involvement” could not be ruled out, he said.

    While the government has not publicly identified a specific country involved, Sky News has reported that the Chinese government is suspected. China’s foreign ministry has denied the allegations, saying in a statement that it “firmly opposes and fights all forms of cyber attacks” and “rejects the use of this issue politically to smear other countries.”

    The payroll company, Shared Services Connected, had known about the breach for months before reporting it to the government, according to The Guardian.

    The United States Marine Forces Special Operations Command (MARSOC) is testing robotic dogs that can be armed with artificial-intelligence-enabled gun systems. According to reporting from The War Zone, the manufacturer of the AI gun system, Onyx Industries, confirmed to reporters at a defense conference this week that as many as two of MARSOC’s robot dogs, developed by Ghost Robotics, are equipped with its weapons systems.

    In a statement to The War Zone, MARSOC clarified that the robot dogs are “under evaluation” and are not yet being deployed in the field. They noted that weapons are just one possible application for the technology, which could also be used for surveillance and reconnaissance. MARSOC emphasized that they are fully compliant with US Department of Defense policies on autonomous weapons.

    The US Marine Corps has previously tested robotic dogs armed with rocket launchers.

    Days after a hacker posted to BreachForums offering to sell data from nearly 50 million Dell customers, the company began notifying its customers of a data breach in a company portal. According to the email sent to the people impacted, the leaked data contains names, addresses, and information about purchased hardware. “The information involved does not include financial or payment information, email address, telephone number or any highly sensitive customer information,” the email to affected customers states.

    [ad_2]

    Dhruv Mehrotra, Andrew Couts

    Source link

  • Finnish hacker gets prison for accessing thousands of psychotherapy records and demanding ransoms

    Finnish hacker gets prison for accessing thousands of psychotherapy records and demanding ransoms

    [ad_1]

    HELSINKI — A Finnish court on Tuesday sentenced a 26-year-old man to six years and three months in prison for hacking thousands of patient records at a private psychotherapy center and seeking ransom from some patients over the sensitive data.

    The case has caused outrage in the Nordic nation, with a record number of people — about 24,000 — filing criminal complaints with police.

    In February 2023, French police arrested well-known Finnish hacker Aleksanteri Kivimäki, who was living under a false identity near Paris. He was deported to Finland. His trial ended last month.

    The Länsi-Uusimaa District Court said Kivimäki was guilty of, among other things, aggravated data breach, nearly 21,000 aggravated blackmail attempts and more than 9,200 aggravated disseminations of information infringing private life.

    The court called the crimes “ruthless” and “very damaging” considering the state of people involved.

    According to the charges, Kivimäki in 2018 hacked into the information system of the Vastaamo psychotherapy center and downloaded its database of some 33,000 clients.

    Vastaamo, which declared bankruptcy in 2021, had branches throughout the country of 5.6 million people and operated as a sub-contractor for Finland’s public health system.

    Prosecutors said Kivimäki first demanded that Vastaamo pay him an amount equivalent to around 370,000 euros ($396,000) in bitcoins in exchange for not publishing the patient records.

    When the center refused, Kivimäki in 2020 began publishing patient information on the dark web and sent patients messages demanding a ransom of 200 euros or 500 euros. About 20 patients paid, prosecutors said.

    Kivimäki denied all charges. His lawyer said he would likely appeal. Prosecutors had sought seven years in prison, the maximum for such crimes under Finnish law.

    Kivimäki was first convicted at age 15 after hacking into over 50,000 servers with software he developed, Finnish newspaper Ilta-Sanomat reported in 2022.

    In the United States, he was convicted over hacking cases involving the U.S. Air Force and Sony Online Entertainment.

    [ad_2]

    Source link

  • Change Healthcare Finally Admits It Paid Ransomware Hackers—and Still Faces a Patient Data Leak

    Change Healthcare Finally Admits It Paid Ransomware Hackers—and Still Faces a Patient Data Leak

    [ad_1]

    For Change Healthcare and the beleaguered medical practices, hospitals, and patients that depend on it, the confirmation of its extortion payment to the hackers adds a bitter coda to an already dystopian story. AlphV’s digital paralysis of Change Healthcare, a subsidiary of UnitedHealth Group, snarled the insurance approval of prescriptions and medical procedures for hundreds of medical practices and hospitals across the country, making it by some measures the most widespread medical ransomware disruption ever. A survey of American Medical Association members, conducted between March 26 and April 3, found that four out of five clinicians had lost revenue as a result of the crisis. Many said they were using their own personal finances to cover a practice’s expenses. Change Healthcare, meanwhile, says that it has lost $872 million to the incident and projects that number to rise well over a billion in the longer term.

    Change Healthcare’s confirmation of its ransom payment now appears to show that much of that catastrophic fallout for the US healthcare system unfolded after it had already paid the hackers an exorbitant sum—a payment in exchange for a decryption key for the systems the hackers had encrypted and a promise not to leak the company’s stolen data. As is often the case in ransomware attacks, AlphV’s disruption of its systems appears to have been so widespread that Change Healthcare’s recovery process has extended long after it obtained the decryption key designed to unlock its systems.

    As ransomware payments go, $22 million wouldn’t be the most that a victim has forked over. But it’s close, says Brett Callow, a ransomware-focused security researcher who spoke to WIRED about the suspected payment in March. Only a few rare payments, such as the $40 million paid to hackers by CNA Financial in 2021, top that number. “It’s not without precedent, but it’s certainly very unusual,” Callow said of the $22 million figure.

    That $22 million injection of funds into the ransomware ecosystem further fuels a vicious cycle that has reached epidemic proportions. Cryptocurrency tracing firm Chainalysis found that in 2023, ransomware victims paid the hackers targeting them fully $1.1 billion, a new record. Change Healthcare’s payment may represent only a small drop in that bucket. But it both rewards AlphV for its highly damaging attacks and may suggest to other ransomware groups that healthcare companies are particularly profitable targets, given those companies are especially sensitive to both the high cost of those cyberattacks financially and the risks they pose to patients’ health.

    Compounding Change Healthcare’s mess is an apparent double-cross within the ransomware underground: AlphV by all appearances faked its own law enforcement takedown after receiving Change Healthcare’s payment in an attempt to avoid sharing it with its so-called affiliates, the hackers who partner with the group to penetrate victims on its behalf. The second ransomware group threatening ChangeHealthcare, RansomHub, now claims to WIRED that they obtained the stolen data from those affiliates, who still want to be paid for their work.

    That’s created a situation where Change Healthcare’s payment provides little assurance that its compromised data won’t still be exploited by disgruntled hackers. “These affiliates work for multiple groups. They’re concerned with getting paid themselves, and there’s no trust among thieves,” Analyst1’s DiMaggio told WIRED in March. “If someone screws someone else, you don’t know what they’re going to do with the data.”

    All of that means Change Healthcare still has little assurance that it’s avoided an even worse scenario than it’s yet faced: paying what may be one of the biggest ransoms in history and still seeing its data spilled onto the dark web. “If it gets leaked after they paid $22 million, it’s pretty much like setting that money on fire,” DiMaggio warned in March. “They’d have burned that money for nothing.”

    [ad_2]

    Andy Greenberg

    Source link

  • Roku Breach Hits 567,000 Users

    Roku Breach Hits 567,000 Users

    [ad_1]

    After months of delays, the US House of Representatives voted on Friday to extend a controversial warrantless wiretap program for two years. Known as Section 702, the program authorizes the US government to collect the communications of foreigners overseas. But this collection also includes reams of communications from US citizens, which are stored for years and can later be warrantlessly accessed by the FBI, which has heavily abused the program. An amendment that would require investigators to obtain such a warrant failed to pass.

    A group of US lawmakers on Sunday unveiled a proposal that they hope will become the country’s first nationwide privacy law. The American Privacy Rights Act would limit the data that companies can collect and give US residents greater control over the personal information that is collected about them. Passage of such legislation remains far off, however: Congress has attempted to pass a national privacy law for years and has thus far failed to do so.

    Absent a US privacy law, you’ll need to take matters into your own hands. DuckDuckGo, the privacy-focused company famous for its search engine, now offers a new product called Privacy Pro that includes a VPN, a tool for having your data removed from people-search websites, and a service for restoring your identity if you fall victim to identity theft. There are also steps you can take to wrench back some of the data used to train generative AI systems. Not all systems out there offer the option to opt out of data collection, but we have a rundown of the ones that do and how to keep your data out of AI models.

    Data collection isn’t the only risk associated with AI advancements. AI-generated scam calls are becoming more sophisticated, with cloned voices sounding eerily like the real thing. But there are precautions you can take to protect yourself from getting swindled by someone using AI to sound like a loved one.

    Change Healthcare’s ongoing ransomware nightmare appears to have gotten worse. The company was originally targeted by a ransomware gang known as AlphV in February. But after the hackers received a $22 million payment early last month, a rift appeared to grow between AlphV and affiliate hackers, who say AlphV took the money and ran without paying other groups that helped them carry out the attack. Now, another ransomware group, RansomHub, claims it has terabytes of Change Healthcare’s data and is attempting to extort the company. Service disruptions caused by the ransomware attack have impacted healthcare providers and their patients across the US.

    That’s not all. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

    The streaming video service Roku warned customers Friday that 576,000 accounts had been compromised, a breach it discovered in the midst of its investigation of a far smaller-scale intrusion that it dealt with in March. Roku said that rather than actually penetrating Roku’s own network through a security vulnerability, the hackers had carried out a “credential-stuffing” attack in which they tried passwords for users that had leaked elsewhere, thus breaking into accounts where users had reused those passwords. The company noted that in less than 400 cases, hackers had actually exploited their access to make purchases with the hijacked accounts. But the company nonetheless reset users’ passwords and is implementing two-factor authentication on all user accounts.

    Apple sent notices via email to users in 92 countries around the world this week, warning them that they had been targeted by sophisticated “mercenary spyware” and that their devices may be compromised. The notice stressed that the company had “high confidence” in this warning and urged potential hacking victims to take it seriously. In a status page update, it suggested that anyone who receives the warning contact the Digital Security Helpline of the nonprofit Access Now and enable Lockdown Mode for future protection. Apple didn’t offer any information publicly about who the hacking victims are, where they’re located, or who the hackers behind the attacks might be, though in its blog post, it compared the malware to the sophisticated Pegasus spyware sold by the Israeli hacking firm NSO Group. It wrote in its public support post that it’s warned users in a total of 150 countries about similar attacks since 2021.

    April continues to be the cruelest month for Microsoft—or perhaps Microsoft’s customers. On the heels of a Cybersecurity Review Board report on Microsoft’s previous breach by Chinese state-sponsored hackers, the Cybersecurity and Infrastructure Security Agency (CISA) published a report this week warning federal agencies that their communications with Microsoft may have been compromised by a group known as APT29, Midnight Blizzard, or Cozy Bear, believed to work on behalf of Russia’s SVR foreign intelligence agency. “Midnight Blizzard’s successful compromise of Microsoft corporate email accounts and the exfiltration of correspondence between agencies and Microsoft presents a grave and unacceptable risk to agencies,” CISA said in the emergency directive. As recently as March, Microsoft said that it was still working to expel the hackers from its network.

    As ransomware hackers seek new ways to bully their victims into giving in to their extortion demands, one group tried the novel approach of calling the front desk of the company it had targeted to verbally threaten its staff. Thanks to one HR manager named Beth, that tactic ended up sounding about as threatening as a clip from an episode of The Office.

    TechCrunch describes a recording of the conversation, which a ransomware group calling itself Dragonforce posted to its dark-web site in a misguided attempt to pressure the victim company to pay. (TechCrunch didn’t identify the victim.) The call starts like any tedious attempt to find the right person after calling a company’s publicly listed phone number, as the hacker waits to speak to someone in “management.”

    Eventually, Beth picks up and a somewhat farcical conversation ensues as she asks that the hacker explain the situation. When he threatens to make the company’s stolen data available for “fraudulent activities and for terrorism by criminals,” Beth responds “Oh, ok,” in an altogether unimpressed tone. She then asks if the data will be posted to “Dragonforce.com.” At another point, she notes to the increasingly frustrated hacker that recording their call is illegal in Ohio, and he responds, “Ma’am, I am a hacker. I don’t care about the law.” Finally, Beth refuses to negotiate with the hacker with a “Well, good luck,” to which the hacker responds, “Thank you, take care.”

    [ad_2]

    Andy Greenberg, Andrew Couts

    Source link

  • Change Healthcare Faces Another Ransomware Threat—and It Looks Credible

    Change Healthcare Faces Another Ransomware Threat—and It Looks Credible

    [ad_1]

    For months, Change Healthcare has faced an immensely messy ransomware debacle that has left hundreds of pharmacies and medical practices across the United States unable to process claims. Now, thanks to an apparent dispute within the ransomware criminal ecosystem, it may have just become far messier still.

    In March, the ransomware group AlphV, which had claimed credit for encrypting Change Healthcare’s network and threatened to leak reams of the company’s sensitive health care data, received a $22 million payment—evidence, publicly captured on Bitcoin’s blockchain, that Change Healthcare had very likely caved to its tormentors’ ransom demand, though the company has yet to confirm that it paid. But in a new definition of a worst-case ransomware, a different ransomware group claims to be holding Change Healthcare’s stolen data and is demanding a payment of their own.

    Since Monday, RansomHub, a relatively new ransomware group, has posted to its dark-web site that it has 4 terabytes of Change Healthcare’s stolen data, which it threatened to sell to the “highest bidder” if Change Healthcare didn’t pay an unspecified ransom. RansomHub tells WIRED it is not affiliated with AlphV and “can’t say” how much it’s demanding as a ransom payment.

    RansomHub initially declined to publish or provide WIRED any sample data from that stolen trove to prove its claim. But on Friday, a representative for the group sent WIRED several screenshots of what appeared to be patient records and a data-sharing contract for United Healthcare, which owns Change Healthcare, and Emdeon, which acquired Change Healthcare in 2014 and later took its name.

    While WIRED could not fully confirm RansomHub’s claims, the samples suggest that this second extortion attempt against Change Healthcare may be more than an empty threat. “For anyone doubting that we have the data, and to anyone speculating the criticality and the sensitivity of the data, the images should be enough to show the magnitude and importance of the situation and clear the unrealistic and childish theories,” the RansomHub contact tells WIRED in an email.

    “We are working with law enforcement and outside experts to investigate claims posted online to understand the extent of potentially impacted data,” Change Healthcare said in an email to WIRED. “Our investigation remains active and ongoing. There is no evidence of any new cyber incident at Change Healthcare.”

    Brett Callow, a ransomware analyst with security firm Emsisoft, says he believes AlphV did not originally publish any data from the incident, and the origin of RansomHub’s data is unclear. “I obviously don’t know whether the data is real—it could have been pulled from elsewhere—but nor do I see anything that indicates it may not be authentic,” he says of the data shared by RansomHub.

    Jon DiMaggio, chief security strategist at threat intelligence firm Analyst1, says he believes RansomHub is “telling the truth and does have Change HealthCare’s data,” after reviewing the information sent to WIRED. While RansomHub is a new ransomware threat actor, DiMaggio says, they are quickly “gaining momentum.”

    If RansomHub’s claims are real, it will mean that Change Healthcare’s already catastrophic ransomware ordeal has become a kind of cautionary tale about the dangers of trusting ransomware groups to follow through on their promises, even after a ransom is paid. In March, someone who goes by the name “notchy” posted to a Russian cybercriminal forum that AlphV had pocketed that $22 million payment and disappeared without sharing a commission with the “affiliate” hackers who typically partner with ransomware groups and often penetrate victims’ networks on their behalf.

    [ad_2]

    Andy Greenberg, Matt Burgess

    Source link

  • Multiverse, the apprenticeship unicorn, acquires Searchlight to put a focus on AI | TechCrunch

    Multiverse, the apprenticeship unicorn, acquires Searchlight to put a focus on AI | TechCrunch

    [ad_1]

    Multiverse, the U.K. unicorn that builds apprenticeship programs for people to learn technology skills while on the job, has made an acquisition as it aims to skill up itself. The company has bought Searchlight, a startup and recruitment platform that uses artificial intelligence-based technology to source talent. The plan will be to use Searchlight’s tech to build new AI products for Multiverse to expand its professional training services.

    “Searchlight’s AI, platform, and exceptional talent will allow us to better diagnose the skills needed within companies and deliver impactful solutions,” said Multiverse’s founder and CEO Euan Blair in a statement. “Combining our scale and world-class learning with Searchlight’s technology and team will ensure even more companies and individuals benefit.”

    Searchlight was co-founded by twin sisters Kerry and Anna Wang (respectively CEO and CTO). Its existing customers (which include Udemy, Zapier, Talkdesk and other tech companies) will continue to be served until the ends of their contracts. After that, the plan will be to wind down Searchlight’s recruitment services as they focus on Multiverse’s business.

    The deal underscores the increasing role that AI is playing in the worlds of work and education. Some people will use AI to speed up what they do; others will claim that AI is taking over certain jobs altogether. This acquisition addresses a third area where AI is appearing: to help build more efficient professional training services to fill recruitment gaps.

    AI and recruitment have at times been strange bedfellows. Amazon famously once had to scrap an AI recruitment tool after it was found to be inherently biased against women for technical roles, due to being trained on typical recruitment data, which more commonly came from men. But technology — and more pointedly awareness around how models are being built and trained — have come a long way since then, Searchlight’s CEO told TechCrunch.

    “Our AI model is able to identify a good match for a role four times greater than a traditional interview,” Wang said. “We’re solving for the exact same problem, which is increased equitable access to economic opportunity for everyone. Multiverse had a great business but they’re looking to expand into an all in one workforce development platform.” Kerry will become director of product at Multiverse, while Anna will become head of AI.

    Founded and led by Blair (the son of former U.K. Prime Minister Tony Blair and high-profile barrister Cherie Booth Blair), Multiverse currently has around 1,000 customers, with its list of past and present clients including Cisco, government organizations, financial services and industrial companies.

    While Multiverse first made its name with a focus on apprenticeships as a viable alternative for people looking to build careers in fast-moving fields like technology, it has since expanded to cover professional training for people already employed. Multiverse has some AI-based services live now, said Ujjwal Singh, the company’s CTO and CPO: it already offers a personalized AI assistant coach for users. Now it clearly wants to keep layering in more technology to improve the overall platform, and its credibility with a set of customers intent on buying and using what appear to be the most modern services they can.

    Financial terms of the deal are not being disclosed, but for some context, the Wang sisters — both impressive and accomplished Stanford grads — took their startup through Y Combinator in 2018. Altogether Searchlight raised nearly $20 million, but that was primarily via a fundraise dating several years back, a $17 million Series A in 2021. Its long list of investors included a number of prominent names such as Accel, Founders Fund, Emerson Collective, and Shasta Ventures. Pitchbook estimated its valuation in 2021 at $64 million.

    Multiverse, meanwhile, was last valued at $1.7 billion in 2022 and has been on a fundraising tear over the years, raising several hundred million dollars from investors that include General Catalyst and Lightspeed. This is the company’s second acquisition after it acquired another YC company, Eduflow, last year.

    From what we understand, investors are “happy” with the outcome. “From the start, Anna and Kerry have been thoughtful about building Searchlight’s AI models to complement their vision,” Keith Rabois, who led the Series A, said in a statement provided to TechCrunch. “Searchlight’s differentiated technology is a magnet for innovative companies like Multiverse. I am excited by the upside of this acquisition for Searchlight and Multiverse.”

    [ad_2]

    Ingrid Lunden

    Source link

  • Colorado women targeted, hacked by Texas cyberstalker on social media apps

    Colorado women targeted, hacked by Texas cyberstalker on social media apps

    [ad_1]

    Federal officials are searching for more potential victims of a Texas man who recently pled guilty to cyberstalking women for almost three years in Colorado, Texas and Arizona.

    Hugo Iram Cardona Jr., 21, used a scheme involving two-factor authentication — an electronic authentication method — to hack into the Snapchat accounts of at least 15 young women, then steal their intimate photos and videos, the U.S. Attorney’s Office in the Western District of Texas reports.

    The Odessa man reached out to his victims on social media platforms like Instagram and “demanded that they ‘apologize,’ or he would publicly release the content,” according to the federal government office. He also pressured most of the young women into video chatting with him “while engaging in sexually explicit conduct.”

    [ad_2]

    Megan Ulu-Lani Boyanton, Lauren Penington

    Source link

  • Identity Thief Lived as a Different Man for 33 Years

    Identity Thief Lived as a Different Man for 33 Years

    [ad_1]

    It’s been a week since the world avoided a potentially catastrophic cyberattack. On March 29, Microsoft developer Andres Freund disclosed his discovery of a backdoor in XZ Utils, a compression tool widely used in Linux distributions and thus countless computer systems worldwide. The backdoor was inserted into the open source tool by someone operating under the persona “Jia Tan” after years of patient work building a reputation as a trustworthy volunteer developer. Security experts believe Jia Tan is the work of a nation-state actor, with clues largely pointing to Russia, although definitive attribution for the attack is still outstanding.

    In early 2022, a hacker operating under the name “P4x” took down the internet of North Korea, after the country’s hackers had targeted him. This week, WIRED revealed P4x’s true identity as Alejandro Caceres, a 38-year-old Colombian American. Following his successful attack on North Korea, Caceres pitched the US military on a “special forces”-style offensive hacking team that would carry out operations similar to the one that made P4x famous. The Pentagon eventually declined, but Caceres has launched a startup, Hyperion Gray, and plans to further pursue his controversial approach to cyberwarfare.

    In mid-February, millions of people lost internet access after three undersea cables in the Arabian Sea were damaged. Some blamed Houthi rebels in Yemen, who had been attacking ships in the region, but the group denied it had sabotaged the cables. But the rebel attacks are still likely to blame—albeit, in a bizarre way. A WIRED analysis of satellite images, maritime data, and more found that the cables were likely damaged by the trailing anchor of a cargo ship that the Houthi rebels had bombed. The ship drifted for two weeks before finally sinking, crossing paths with the cables at the time they were damaged.

    The myth that Google Chrome’s Incognito mode provides adequate privacy protections can finally be put to rest. As part of a settlement over Google’s Incognito privacy claims and practices, the company has agreed to delete “billions” of records collected while users browsed in Incognito mode. It will also further clarify how much user data can be collected by Google and third parties while Incognito is enabled, and take further steps to protect user privacy. There are other privacy-focused browsers that can replace Chrome. But if you’re still using it, make sure to update it to patch some serious security flaws.

    But that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    A 58-year-old hospital systems administrator pleaded guilty this week to US federal charges after he was caught using another man’s name for more than 30 years. Matthew David Keirans allegedly stole the identity of William Woods in 1988, when the two men worked at a hot dog cart in Albuquerque, New Mexico, according to the US Attorney’s Office for the Northern District of Iowa. Over the decades, Keirans obtained employment, bank accounts, loans, and insurance, and paid taxes, under the Woods name. Keirans even had a child whose last name is Woods.

    The real William Woods, meanwhile, reportedly learned that someone else was using his identity in 2019. At the time, Woods was unhoused and living in Los Angeles. He contacted a bank where “William Woods” had an account, providing his real Social Security card and California ID card to prove his identity. However, he could not answer the security questions to gain access. The bank called Keirans—who was pretending to be Woods—and Keirans convinced the bank employee that the real Woods should not have access to the accounts. The Los Angeles Police Department then arrested the real Woods and charged him with identity theft after Keirans provided officers with false documents and information.

    In a nightmarish twist, during judicial proceedings, the real Woods accurately maintained that “William Donald Woods” was his true identity, prompting the court to order him to a mental institution. The real Woods ultimately spent 428 days in jail and 147 days in a mental hospital before his release.

    [ad_2]

    Dell Cameron, Andrew Couts

    Source link

  • The XZ Backdoor: Everything You Need to Know

    The XZ Backdoor: Everything You Need to Know

    [ad_1]

    On Friday, a lone Microsoft developer rocked the world when he revealed a backdoor had been intentionally planted in XZ Utils, an open source data compression utility available on almost all installations of Linux and other Unix-like operating systems. The person or people behind this project likely spent years on it. They were likely very close to seeing the backdoor update merged into Debian and Red Hat, the two biggest distributions of Linux, when an eagle-eyed software developer spotted something fishy.

    “This might be the best-executed supply chain attack we’ve seen described in the open, and it’s a nightmare scenario: malicious, competent, authorized upstream in a widely used library,” software and cryptography engineer Filippo Valsorda said of the effort, which came frightfully close to succeeding.

    Researchers have spent the weekend gathering clues. Here’s what we know so far.

    What Is XZ Utils?

    XZ Utils is nearly ubiquitous in Linux. It provides lossless data compression on virtually all Unix-like operating systems, including Linux. XZ Utils provides critical functions for compressing and decompressing data during all kinds of operations. XZ Utils also supports the legacy .lzma format, making this component even more crucial.

    What Happened?

    Andres Freund, a developer and engineer working on Microsoft’s PostgreSQL offerings, was recently troubleshooting performance problems a Debian system was experiencing with SSH, the most widely used protocol for remotely logging in to devices over the Internet. Specifically, SSH logins were consuming too many CPU cycles and were generating errors with valgrind, a utility for monitoring computer memory.

    Through sheer luck and Freund’s careful eye, he eventually discovered the problems were the result of updates that had been made to XZ Utils. On Friday, Freund took to the Open Source Security List to disclose the updates were the result of someone intentionally planting a backdoor in the compression software.

    What Does the Backdoor Do?

    Malicious code added to XZ Utils versions 5.6.0 and 5.6.1 modified the way the software functions when performing operations related to .lzma compression or decompression. When these functions involved SSH, they allowed for malicious code to be executed with root privileges. This code allowed someone in possession of a predetermined encryption key to log in to the backdoored system over SSH. From then on, that person would have the same level of control as any authorized administrator.

    How Did This Backdoor Come to Be?

    It would appear that this backdoor was years in the making. In 2021, someone with the username JiaT75 made their first known commit to an open source project. In retrospect, the change to the libarchive project is suspicious, because it replaced the safe_fprint funcion with a variant that has long been recognized as less secure. No one noticed at the time.

    The following year, JiaT75 submitted a patch over the XZ Utils mailing list, and, almost immediately, a never-before-seen participant named Jigar Kumar joined the discussion and argued that Lasse Collin, the longtime maintainer of XZ Utils, hadn’t been updating the software often or fast enough. Kumar, with the support of Dennis Ens and several other people who had never had a presence on the list, pressured Collin to bring on an additional developer to maintain the project.

    In January 2023, JiaT75 made their first commit to XZ Utils. In the months following, JiaT75, who used the name Jia Tan, became increasingly involved in XZ Utils affairs. For instance, Tan replaced Collins’ contact information with their own on oss-fuzz, a project that scans open source software for vulnerabilities that can be exploited. Tan also requested that oss-fuzz disable the ifunc function during testing, a change that prevented it from detecting the malicious changes Tan would soon make to XZ Utils.

    In February of this year, Tan issued commits for versions 5.6.0 and 5.6.1 of XZ Utils. The updates implemented the backdoor. In the following weeks, Tan or others appealed to developers of Ubuntu, Red Hat, and Debian to merge the updates into their OSes. Eventually, one of the two updates made its way into several releases, according to security firm Tenable. There’s more about Tan and the timeline here.

    Can You Say More About What This Backdoor Does?

    In a nutshell, it allows someone with the right private key to hijack sshd, the executable file responsible for making SSH connections, and from there to execute malicious commands. The backdoor is implemented through a five-stage loader that uses a series of simple but clever techniques to hide itself. It also provides the means for new payloads to be delivered without major changes being required.

    Multiple people who have reverse-engineered the updates have much more to say about the backdoor. Developer Sam James provided an overview here.

    [ad_2]

    Dan Goodin, Ars Technica

    Source link

  • Yogurt Heist Reveals a Rampant Form of Online Fraud

    Yogurt Heist Reveals a Rampant Form of Online Fraud

    [ad_1]

    The Journal’s story reveals that cargo hijacking fraud remains a serious problem—one that cost $500 million in 2023, quadruple the year before. Victims say load board operators need to do more to verify users’ identities, and that law enforcement and regulators also need to do more to address the thefts.

    Multifactor authentication (MFA) has served as a crucial safeguard against hackers for years. In Apple’s case, it can require a user to tap or click “allow” on an iPhone or Apple Watch before their password can be changed, an important protection against fraudulent password resets. But KrebsOnSecurity reports this week that some hackers are weaponizing those MFA push alerts, bombarding users with hundreds of requests to force them to allow a password reset—or at the very least, deal with a very annoying disruption of their device. Even when a user does reject all those password reset alerts, the hackers have, in some cases, called up the user and pretended to be a support person—using identifying information from online databases to fake their legitimacy—to social engineer them into resetting their password. The solution to the problem appears to be “rate-limiting,” a standard security feature that limits the number of times someone can try a password or attempt a sensitive settings change in a certain time period. In fact, the hackers may be exploiting a bug in Apple’s rate limiting to allow their rapid-fire attempts, though the company didn’t respond to Krebs’ request for comment.

    Israel has long been accused of using Palestinians as subjects of experimental surveillance and security technologies that it then exports to the world. In the case of the country’s months-long response to Hamas’ October 7 massacre—a response that has killed 31,000 Palestinian civilians and displaced millions more from their homes—that surveillance now includes using controversial and arguably unreliable facial recognition tools among the Palestinian population. The New York Times reports that Israel’s military intelligence has adopted a facial recognition tool built by a private tech firm called Corsight, and has used it in its attempts to identify members of Hamas—particularly those involved in the October 7 attack—despite concerns that the tech was sometimes faulty and produced false positives. In one case, for instance, the Palestinian poet Mosab Abu Toha was pulled out of a crowd by soldiers who had somehow identified him by name, before he was beat, accused of being a member of Hamas, and interrogated, before soldiers then told him the interrogation had been a “mistake.”

    In other dystopian AI news, The Guardian this week reported on a government project in San Jose, California, that used AI-enabled computer vision technology to identify encampments and vehicles lived in by unhoused people. In the project, video recorded from a car around the city is given to participating companies including Ash Sensors, Sensen.AI, Xloop Digital, Blue Dome Technologies, and CityRover, which use it as training data to develop a system that can recognize tents or vehicles that people might be living in. While the project has been described as a way to identify and help people in need, advocates for the unhoused in San Jose say they’re concerned the data is likely to instead be given to the police, and thus as just another form of surveillance targeting the most vulnerable inhabitants of the city.

    Radical libertarian Ammon Bundy, a well-known figure on the far right, has been on the run since last year, charged with contempt of court after being ordered to pay $50 million to an Idaho hospital he’d accused of child trafficking and leading a campaign of harassment that targeted its staff. Then last month, he posted a provocative video to YouTube titled, “Want to Know Where Ammon Bundy Is?” The open source detectives at Bellingcat apparently did: They found enough evidence in Bundy’s videos to convincingly reveal his location. Bellingcat was able to use material like a school calendar in the background of one shot, a mountain range in another, and a highway sign in a third to place Bundy in a certain county in southern Utah. When contacted by Bellingcat, Bundy denied hiding and wrote, a little confusingly, that “at any time peace officers could find me if they wish.”

    [ad_2]

    Andy Greenberg, Andrew Couts

    Source link

  • ‘Malicious Activity’ Hits the University of Cambridge’s Medical School

    ‘Malicious Activity’ Hits the University of Cambridge’s Medical School

    [ad_1]

    The University of Cambridge is constantly ranked among the world’s top universities, with its medical school and vast research facilities among the very best. But for the past month, staff at the prestigious medical school have had work hampered following “malicious activity” on its computer network.

    An emailed “staff notice” seen by WIRED, believed to have been sent at the end of February, alerted staff to the disruption and said the university was working to get systems back online as soon as possible. However, weeks later, the incident is still ongoing, and little information has been made public about the nature of the incident.

    “IT services provided by the Clinical School Computing Service (CSCS) have been disrupted by malicious activity,” the email reviewed by WIRED says. “We appreciate that some staff and students are experiencing significant disruption to their work and studies, and we are grateful for their patience and understanding.”

    The University has confirmed to WIRED that its systems have been impacted, that some services have been voluntarily taken offline, and that while it has “contained” the incident, the disruption is ongoing and its investigations will likely take some time to complete. No data has been taken, it says. The UK’s national cybersecurity body and the country’s data regulator are also looking into the events.

    The email message sent to staff last month said a “Critical Incident Management Team” has been set up to handle the response. At the time the message was sent, the email said, there was no access to the local IT network and Wi-Fi, and wired internet access had been turned off in impacted buildings, with the Wi-Fi set to be turned on again that same day.

    The CSCS provides IT support to staff and researchers in the university’s School of Clinical Medicine. An archived version of its website says there are more than 5,800 devices on its network, and the team provides computers and servers to staff. The email seen by WIRED says that the CSCS also serves the Department of Zoology, Sainsbury Laboratory, which researches plant life; the Stem Cell Institute; and Milner Institute of the School of Biological Sciences, which researches emerging therapies. All have been impacted.

    A University of Cambridge spokesperson confirmed the incident to WIRED, saying that “malicious activity” was found on the Clinical School Computing Service last month. “We took immediate action to contain the incident including voluntarily taking some systems offline,” the spokesperson said in a statement. “As a result, there is ongoing interruption to some services.”

    It is not clear what the “malicious activity” entails or whether the activity is an attack by criminal hackers or an incident of a different nature. Multiple staff members at university departments did not respond to questions sent by WIRED about whether their work or research had been disrupted, or they directed questions to the press office as they are not authorized to speak about the incident.

    The university spokesperson did not describe the nature of the problem; however, they said a business continuity plan has been implemented to minimize disruption, and all of the other university and college IT systems are working as normal and are not impacted. “This will likely take some time to complete,” the spokesperson said of its ongoing investigation. “Investigations have found no evidence that data has been taken or transferred without authorization. We have also received third-party assurance that the incident is contained.” They say the situation has moved on since the email seen by WIRED was sent, and it is not possible to characterize the level of disruption across all departments.

    [ad_2]

    Matt Burgess

    Source link

  • North Korea Cyberattacks Account for 50% Foreign Currency Earnings, $3B Stolen in Crypto

    North Korea Cyberattacks Account for 50% Foreign Currency Earnings, $3B Stolen in Crypto

    [ad_1]

    The United Nations (UN) Security Council has released a report showing North Korea earns 50% of its foreign exchange earnings from cyberattacks.

    The council is also investigating involvement in cyberattacks associated with cryptocurrency companies, which reportedly caused losses of approximately $3 billion (450 billion yen).

    North Korea’s Cyberattacks Target Cryptocurrency

    North Korea primarily conducts cyberattacks by compromising digital wallet private keys and seed phrases, which are crucial for wallet security. These breaches result in the transfer of victims’ assets to North Korean-controlled wallets, often exchanged for USDT or Tron, which are then converted to fiat currency through large-volume OTC brokers.

    Hackers associated with North Korea stole at least $600 million in cryptocurrency in 2023. If confirmed to be North Korean, further hacks in the final days of the year could increase this total to around $700 million. Despite a 30% reduction from the $850 million haul in 2022, the Democratic People’s Republic of Korea (DPRK) accounted for almost a third of all funds stolen in crypto attacks last year.

    Attacks attributed to the DPRK were, on average, ten times as damaging as those not linked to the country. Since 2017, Pyongyang-linked threat actors have caused nearly $3 billion in cryptocurrency losses.

    Hackers Allegedly Funding Nuclear Programs

    Hackers linked to North Korea have been alleged to be using the stolen cryptocurrency to fund their nuclear weapons programs. Facing United Nations sanctions since its initial nuclear test in 2006, North Korea’s financial resources for its nuclear efforts have been targeted.

    In its report, the UN Panel of Experts mentioned that it will review sanctions enforcement against North Korea from July 2023 to January 2024, focusing on evasion tactics. The findings will help the Security Council consider new sanctions against violators.

    The report highlights that cyberattacks fund about 40% of North Korea’s weapons of mass destruction development costs. There has been a noted uptick in cyberattacks targeting defense-oriented firms, with entities linked to North Korea’s Reconnaissance General Directorate increasingly pooling resources and cyber tools.

    The panel’s investigations also explored the possibility of Hamas using weaponry of North Korean origin, a claim supported by Israel, which asserts that Hamas has dozens of North Korean missiles and anti-tank arms. North Korea, however, refutes these claims, dismissing them as baseless.

    Despite sanctions aiming to curb North Korea’s nuclear program by limiting funds and banning trade, North Korea continues to import banned petroleum products and export luxury goods, with trade volumes in 2023 exceeding those of 2022, indicating persistent sanctions evasion.

    SPECIAL OFFER (Sponsored)

    LIMITED OFFER 2024 for CryptoPotato readers at Bybit: Use this link to register and open a $500 BTC-USDT position on Bybit Exchange for free!

    [ad_2]

    Wayne Jones

    Source link

  • This Blockchain Game Was Exploited for $4.6 Million Right Before its Launch

    This Blockchain Game Was Exploited for $4.6 Million Right Before its Launch

    [ad_1]

    Super Sushi Samurai, a blockchain game native to layer-2 solution Blast, was exploited hours before its much-anticipated gaming product was launched.

    The exploit, reportedly orchestrated by a white hat hacker, has resulted in a loss of $4.6 million due to a bug in its smart contract code.

    Smart Contract Bug Exploited

    According to an announcement from the Super Sushi Samurai team, the exploit was due to a bug in the smart contract code, allowing an unauthorized party to initiate an infinite mint function. This resulted in the creation of an excessive number of tokens that were subsequently sold into the liquidity pool.

    CertiK, an on-chain security firm, confirmed the extent of the exploit, stating that $4.6 million worth of tokens were affected. According to CoinGecko data, the exploit led to a 99% token value slippage following an unauthorized token dump. The attacker managed to get 1310 ETH from the token’s main liquidity pool by exploiting the smart contract vulnerability.

    Investigations into the incident revealed that an unauthorized party acquired 690 million SSS tokens and initiated a series of transactions through an attack contract designed for this purpose.

    Exploiting a vulnerability within the platform’s update function, the attacker duplicated the tokens in their possession 25 times, inflating the quantity to 11.5 trillion, which was then exchanged for approximately 1,310 ETH.

    Recovery Efforts

    Following the breach, Super Sushi Samurai has actively engaged with its community, providing updates and assurances through its official Telegram channel and other social media platforms.

    In an X post, they revealed that the exploit was conducted by a white hat hacker who is currently in communication with their team. The hacker’s message, visible on Blastscan, indicated that it was a rescue mission and plans to reimburse affected users were underway.

    They have also disclosed the address containing the compromised funds to facilitate tracking and potential recovery of the lost assets and that they are working with the white hat hacker to ensure the safe return of funds.

    Meanwhile, a “post-mortem” update from Super Sushi Samurai outlines the extent of the damage, with negotiations ongoing to reach a resolution that safeguards both users and the white hat hacker involved in the incident.

    SPECIAL OFFER (Sponsored)

    LIMITED OFFER 2024 for CryptoPotato readers at Bybit: Use this link to register and open a $500 BTC-USDT position on Bybit Exchange for free!

    [ad_2]

    Wayne Jones

    Source link