Peiter “Mudge” Zatko’s claims about the company’s lax security are all bad. But one clearly captures the extent of systemic issues.

On Tuesday, both CNN and _The Washington Post_ reported on accusations from former Twitter chief security officer Peiter Zatko, often known as “Mudge,” that the company’s security practices are dangerously lacking. It’s a litany of charges that range from misleading bot counts to the employment of a known foreign government agent. But one allegation stands out among the rest.

Engineers across Twitter, according to Zatko’s disclosure, had extensive access to the social network's live, deployed software platform. Not only that, there was also minimal monitoring and logging to track who did what in this production environment. That would leave an opening for someone with unintended access or malign intentions to view user data or even make changes to the platform without raising alarms or leaving a clear trail. While all of Zatko’s claims are serious, none more clearly captures the allegation of fundamental, systemic issues within the company.

Last month, Zatko and his attorneys sent hundreds of pages of documents to the US Department of Justice, Securities and Exchange Commission, and Federal Trade Commission detailing the myriad allegations of security and privacy failures at Twitter. The claims have potentially significant implications in the dispute about whether Elon Musk must go through with his agreement to purchase the company for $44 billion. If true, they also have immediate ramifications for Twitter's hundreds of millions of users.

“Twitter is grossly negligent in several areas of information security,” Zatko wrote in a final report to the company after being fired in January. He added in his government disclosure, “It was impossible to protect the production environment. All engineers had access. There was no logging of who went into the environment or what they did.”

“Mr. Zatko was fired from his senior executive role at Twitter in January 2022 for ineffective leadership and poor performance,” Twitter said in a statement provided to WIRED by spokesperson Lindsay McCallum-Rémy. “What we’ve seen so far is a false narrative about Twitter and our privacy and data security practices that is riddled with inconsistencies and inaccuracies and lacks important context. Mr. Zatko's allegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter, its customers, and its shareholders. Security and privacy have long been company-wide priorities at Twitter and will continue to be.”

Twitter first hired Zatko in November 2020, months after a sweeping attack resulted in the compromise of multiple high-profile accounts, including those of Apple, Kanye West, Jeff Bezos, and Elon Musk. Previously, he’d built a strong reputation over decades as part of the hacker collective L0pht and a cybersecurity expert for organizations including the Defense Advanced Research Projects Agency, Google, and Stripe.

The documents Zatko submitted describe a situation in which almost a third of employee laptops did not receive automatic software updates, and half of Twitter's data center servers had not been adequately updated and didn't support data encryption at rest. Zatko also alleges that there was no management protocol for staffers' smartphones, meaning that the company had no oversight for thousands of employee devices that connected to “core” systems. But his allegations about security issues in Twitter's “fundamental architecture” reflect the core of the problems.

Zakto further alleges that Twitter has no comprehensive development or testing environments for piloting new features and system upgrades before launching them in the live production software. As a result, Zatko describes a situation where engineers would work alongside live systems and “test directly on the commercial service, leading to regular service disruptions.” And the documents allege that half of Twitter's employees had privileged access to live production systems and user data without monitoring to be able to catch any rogue actions or trace unwanted activity. Zatko’s complaint describes Twitter as having roughly 11,000 staffers. Twitter says it has about 7,000 employees currently.

The complaints assert that these poor security practices explain Twitter's track record of security incidents, data breaches, and dangerous user account takeovers.

“We are reviewing the redacted claims that have been published," Twitter CEO Parag Agrawal wrote in a message to Twitter staff this morning. “We will pursue all paths to defend our integrity as a company and set the record straight.”

Twitter says that all employee computers are centrally managed and that its IT department can force updates or impose access restrictions if updates aren't installed. The company also said that before a computer can connect to production systems, it must pass a check to ensure its software is up-to-date, and that only employees with a “business justification” can access the production environment for “specific purposes.”

Al Sutton, cofounder and chief technology officer of Snapp Automotive, was a Twitter staff software engineer from August 2020 to February 2021. He noted in a tweet on Tuesday that Twitter never removed him from the employee GitHub group that can submit software changes to code the company manages on the development platform. Sutton had access to private repositories for 18 months after being let go from the company, and he posted evidence that Twitter uses GitHub not only for public, open source work, but for internal projects as well. Within about three hours of posting about the access, Sutton reported that it had been revoked.

“I think Twitter is being pretty casual about Mudge's claims, so I thought a verifiable example might be useful for folks,” he told WIRED. When asked whether Zatko’s accusations track with his own experience working at Twitter, Sutton added, “I think the best thing to say here is that I have no reason to doubt his claims.”

Security engineers and researchers emphasize that while there are different ways to approach production environment security, there is a conceptual problem if employees have broad access to user data and deployed code without extensive logging. Some organizations take the approach of drastically limiting access, while others use a combination of broader access and constant monitoring, but either option must be a conscious choice that a company invests heavily in. After the Chinese government breached Google in 2010, for example, the company went all in on the former approach. 

“It’s not actually that unusual for companies to have relatively liberal policies about giving engineers access to production systems, but when they do they are very, very strict about logging everything that gets done,” says Perry Metzger, managing partner of the consultancy Metzger, Dowdeswell & Company. “Mudge has a sterling reputation, but let’s say he was completely incompetent. The easy thing for them to do would be to provide technical details of the logging systems that they use for engineer access to production systems. But what Mudge is portraying is a culture where people would prefer to cover things up than to fix them, and that is the disturbing bit.”

Zatko and Whistleblower Aid, the nonprofit legal group representing him, say they stand by the documents released on Tuesday. “Twitter has an outsized influence on the lives of hundreds of millions around the world, and it has fundamental obligations to its users and the government to provide a safe and secure platform,” Libby Liu, CEO of Whistleblower Aid, said in a statement.

For now, though, the allegations raise a swath of serious concerns that seem unlikely to be quickly explained away or comprehensively resolved.

The Most Damning Allegation in the Twitter Whistleblower’s Report

As a graduation prank, four high school students hijacked 500 screens across six school buildings to troll their classmates and teachers.

At 10:55 am on April 30, 2021, all the TV screens and classroom projectors at six schools in Cook County, Illinois, started controlling themselves. Screens that were turned off powered up. Projectors that were already on automatically switched to the HDMI input. “Please standby for an important announcement,” read a message that flashed up on the displays. A five-minute timer, counting down to zero, sat under the ominous message.

A teacher in one classroom tried to turn the projector off using the infrared remote, but it was useless. “They overtook our projector,” the teacher, caught on video, told students. The group speculated that it could be a message from President Joe Biden, failing that, “big brother.” The same scene was repeating itself across dozens of classrooms in Illinois’ school district 214—home to 12,000 students. In classrooms and hallways, more than 500 screens displayed the countdown. The system had been hijacked.

Tucked in the corner of one classroom was Minh Duong, a senior on the verge of graduating. Duong sat pouring over his laptop, chatting with three other friends—Shapes, Jimmy, and Green—on encrypted messenger Element, making sure the last of his custom code executed correctly. As the countdown hit zero, a grainy, gyrating Rick Astley burst into the first notes of “Never Gonna Give You Up.”

“I was walking down the hallway, and everyone was kind of laughing—it was kind of fun to watch,” Duong, who also goes by the moniker WhiteHoodHacker, tells WIRED. Later that day, at 2:05 pm, Duong and his friends took over the schools’ PA systems and played the song one last time.

The elaborate high school graduation prank—dubbed The Big Rick by its architects—was one of the largest rickrolls to ever take place, taking months of planning to pull off. “I was actually extremely hesitant about doing the entire district,” Duong says.

During the process, the group broke into the school’s IT systems; repurposed software used to monitor students’ computers; discovered a new vulnerability (and reported it); wrote their own scripts; secretly tested their system at night; and managed to avoid detection in the school’s network. Many of the techniques were not sophisticated, but they were pretty much all illegal.

Minh Duong started hacking his school during his freshman year when he was about 14. “I didn't understand basic ethics or responsible disclosure and jumped at every opportunity to break something,” he writes in a blog post describing the rickroll. (Duong recently presented the Big Rick at the Def Con hacker conference, where he revealed new details about the incident.) During his freshman year, using a computer in a cupboard next to the IT classroom, he started scanning the school’s internal network, looking for connected devices and ultimately laying the groundwork for the rickroll years later.

Duong, now 19, says he was able to access internet-connected security cameras throughout the school, posting a picture of himself in his eventual blog post. (He says the issue was reported and access was shut down—and he was caught and told to stop scanning the school’s network.)

The Big Rick involved three key components, two of which were originally accessed in Duong’s early high school years. First, he acquired a teacher’s version of LanSchool, a “classroom management” software that can track everything students do, including monitor students’ screens and log keystrokes. They used the software to run scans and exploit the systems while making them appear as if they were in one of the district’s other schools.

Next, he had access to the school’s IPTV system, which controls hundreds of projectors and TVs across the district. When the pandemic struck, Duong says, he mostly forgot about the access to the systems, which he had scanned years earlier, and the school didn’t go back to in-person learning until the end of his senior year. That’s when he decided to do the rickroll, which he says he picked because teachers would likely get the joke.

Duong and his three friends managed to get some access to the projectors and TVs using default usernames and passwords, which hadn’t been changed. The system has receivers that directly connect to projectors and displays, encoders that broadcast video, and servers that allow products to be managed centrally by administrators.

However, Duong decided sending out the rickroll using the servers would be too risky. “Every time you make a request, it’s going to send a lot of requests to all the projectors,” Duong explains. “That’s going to generate a lot of traffic. That’s going to make things very detectable.”

Instead, he created a script to act as a payload, which could be uploaded to each receiver ahead of the rickroll. During the month before the Big Rick, the group sent the script to each of the media players in several batches, reducing the chances of school admins detecting them. He tested the streaming setup at night, so as not to disrupt classes. Duong says he would remotely connect to one PC in the school’s computer lab, which he remotely accessed through the computer club. “I would record a video to test if the projector displayed the stream correctly,” he says, posting a video of the setup.

The group also built out the system—running it on a loop—to avoid teachers turning it off on the day of the rickroll. “Every 10 seconds, the display would power on and set the maximum volume,” Duong wrote in the blog post. The only real way for teachers to disable the stream would be to change the input source from HDMI on the projectors or pull the power cable. “Then we disable infrared remotes,” he says, in case teachers tried to use them to stop the videostream. There was also a failsafe: A few seconds before Astley was unleashed, the projectors were reset to play the correct feed.

Three days before the rickroll, with most of the setup prepared, the group had a breakthrough. While scanning the district network (again) they found EPIC, the Education Paging and Intercom Communications system—the prank’s third component. This controls the hallway and classroom speakers and is used for teacher announcements, fire alarms, and end-of-lesson bells. It can also play custom audio tracks.

Like the IPTV system, the group tried to access EPIC using default usernames and passwords. “It's not really like a sophisticated attack,” Duong says. “The whole thing is script kiddies using default passwords and doing random stuff there.” But the defaults didn’t work.

“I GOT THE PASSWORD TO THE PPA SYSTEM,” Shapes messaged the group on April 29. Yes, the default had been changed—to a password example given in the user manual, which was available online. From here, the team discovered another admin account—the password was password—that could allow them to access the entire district’s speakers.

The night before the Big Rick, the speaker system was set to automatically trigger in the afternoon.

While the Big Rick was always intended as a high school prank—Duong says other pranks last year included students toilet-papering some trees—the hacking was very likely to be outside the law. The students accessed networks they weren’t supposed to—a lawyer might call it “unauthorized access” under the Computer Fraud and Abuse Act. And a malicious hacker could have stolen data, moved through the systems, or used the access to try to cause harm. “I totally was expecting they would get the police in,” Duong says, adding things were “pretty scary” for a bit.

Knowing the risk, the four students involved were keen to show they hadn’t accessed the school’s equipment for anything more than a prank. When the rickroll ended, their script reset the systems to their original state. The only thing they couldn’t do, Duong says, was to make sure that projectors that had been off turned back off. All told, it was a success.

“Definitely the teachers found it very funny,” Duong says. One tweeted: “😂😂😂 Very clever, seniors!” Duong says the only complaint he heard was that Astley was too loud. “Which is fair, because I set the volume to max.” But it wasn’t only the teachers’ response that had the group worried.

“The thing that really prevented us from being in trouble is the report that we sent,” Duong says. Ahead of the rickroll, the team wrote up a 26-page report, which was sent to the admins straight after the incident, that detailed what they had done and provided security suggestions.

The report—Duong shared a redacted version with WIRED—says the group had a set of guidelines. It says they would not do anything that could harm the safety of others; would look to keep any disruption to learning at a minimum (they picked a Friday near the end of term, right at the end of a period); would not access sensitive private information; would not leave systems weaker than they found them; and all the decisions would be made together as a group. Their report also explained what school administrators could do to stop this from happening again—for instance, changing all default passwords.

A couple of weeks later, the school replied. “Because of your strict guidelines and openness to share the information, we will not be pursuing discipline,” an email from the district’s director of technology says. Duong shared the email as part of his talk at Def Con.

A spokesperson for the D214 school district tells WIRED they can confirm the events in Duong’s blog post happened. They say the district does not condone hacking and the “incident highlights the importance of the extensive cybersecurity learning opportunities the District offers to students.”

“The District views this incident as a penetration test, and the students involved presented the data in a professional manner,” the spokesperson says, adding that its tech team has made changes to avoid anything similar happening again in the future.

The school also invited the students to a debrief, asking them to explain what they had done. “We were kind of scared at the idea of doing the debrief because we have to join a Zoom call, potentially with personally identifiable information,” Duong says. Eventually, he decided to use his real name, while other members created anonymous accounts. During the call, Duong says, they talked through the hack and he provided more details on ways the school could secure its system.

Duong, who is now studying computer science at the University of Illinois at Urbana-Champaign, insists the rickroll was just a high school prank, not a wider message on the state of his school’s security. (In recent months, cybersecurity agencies have warned against schools being hit, and some have suffered from ransomware attacks.)

“It was meant to be something that’s fun, and not super serious, or have some sort of message about the state of our school’s security,” he says. In several places during his blog post and Def Con talk, Duong reiterates he could have faced trouble. “I definitely cannot tell anyone to do something like this,” he says. “Because it really is illegal. I was just a lucky case.”

Inside the World’s Biggest Hacker Rickroll

Police in India's capital say they only require an 80 percent accuracy rate for matches, raising new alarm bells for civil liberty advocates.

Indian law enforcement is starting to place huge importance on facial recognition technology. Delhi police, looking into identifying people involved in civil unrest in northern India in the past few years, said that they would consider 80 percent accuracy and above as a “positive” match, according to documents obtained by the Internet Freedom Foundation through a public records request.

Facial recognition’s arrival in India’s capital region marks the expansion of Indian law enforcement officials using facial recognition data as evidence for potential prosecution, ringing alarm bells among privacy and civil liberties experts. There are also concerns about the 80 percent accuracy threshold, which critics say is arbitrary and far too low, given the potential consequences for those marked as a match. India’s lack of a comprehensive data protection law makes matters even more concerning.

The documents further state that even if a match is under 80 percent, it would be considered a “false positive” rather than a negative, which would make that individual “subject to due verification with other corroborative evidence.”

“This means that even though facial recognition is not giving them the result that they themselves have decided is the threshold, they will continue to investigate,” says Anushka Jain, associate policy counsel for surveillance and technology with the IFF, who filed for this information. “This could lead to harassment of the individual just because the technology is saying that they look similar to the person the police are looking for.” She added that this move by the Delhi Police could also result in harassment of people from communities that have been historically targeted by law enforcement officials.

In response to the IFF’s records request, police said they are using convict photographs and dossier photographs to run facial recognition. They added that these could be used as evidence but declined to share more details. They clarified, however, that in a case of a positive match, police officials would conduct further “empirical investigation” before taking any kind of legal action. Delhi Police did not respond to WIRED’s emailed requests for comment.

Divij Joshi, who has spent time researching the legality of facial recognition systems, says the threshold of an 80 percent match is virtually meaningless. Joshi explains that accuracy numbers are highly contingent upon the conditions for testing facial recognition technology models against particular benchmark data sets.

“Normal accuracy with facial recognition or machine learning systems is determined by comparing a model developed on training data and validation data with a benchmarking data set,” says Joshi, a doctoral candidate at University College London. “Once the training data is tweaked, it has to be benchmarked against a third-party data set or a slightly different data set.” This benchmarking, he says, is what is typically used to calculate the predictive accuracy percentage.

Evidence of racial bias in facial recognition models has long made the technology’s use problematic. And while many variables affect the accuracy of facial recognition systems, widespread police use of a system with an overall 80 percent accuracy threshold appears to be highly unusual. A 2021 US National Institute of Standards and Technology study found that systems used to match a single scan of travelers’ faces to a database that contains their photos had an accuracy rate of 99.5 percent or better. Other studies, however, have found error rates as high as 34.7 percent when used to identify women with darker complexions.

The Low Threshold for Face Recognition in New Delhi

Plus: The Twilio hack snags a reporter, a new tool to check for spyware, and the Canadian weed pipeline gets hit by a cyberattack.

A new jailbreak for John Deere tractors, demonstrated at the Defcon security conference in Las Vegas last Saturday, put a spotlight on the strength of the right-to-repair movement as it continues to gain momentum in the United States. Meanwhile, researchers are developing expanded tools for detecting spyware on Windows, Mac, and Linux computers as the malware continues to proliferate. 

WIRED took a deep look this week at the Posey family that wielded the Freedom of Information Act to learn more about the US Department of Defense and promote transparency—and make millions in the process. And researchers found a potentially crucial flaw in the Veterans Affairs department's VistA electronic medical record system that has no easy fix.

If you need some digital security and privacy projects this weekend for your own protection, we've got tips on how to create a secure folder on your phone, how to set up and most safely use the Signal encrypted messaging app, and Android 13 privacy setting tips to keep your data exactly where you want it and nowhere you don't. 

And there's more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

The Janet Jackson classic “Rhythm Nation” may be from 1989, but it’s still blowing up the charts—and some hard drives. This week, Microsoft shared details of a vulnerability in a widely used 5400-RPM laptop hard drive sold around 2005. Just by playing “Rhythm Nation” on or near a vulnerable laptop, the disk can crash and take its laptop down with it. Spinning disk hard drives have been increasingly phased out in favor of solid-state drives, but they still persist in a host of devices around the world. The flaw, which has its own CVE vulnerability tracking number, is due to the fact that “Rhythm Nation” inadvertently produces one of the natural resonant frequencies created by the movement in the hard drive. Who wouldn’t vibe hard with such a classic jam? Microsoft says the manufacturer that made the drives developed a special filter for the audio processing system to detect and quash the frequency when the song was playing. Audio hacks that manipulate speakers, grab information leaked in vibrations, or exploit resonant frequency vulnerabilities aren’t discovered often in research but are an intriguing area. 

When the cloud services company Twilio announced last week that it had been breached, one of its customers that suffered knock-on effects was the secure messaging service Signal. Twilio underpins Signal's device verification service. When a Signal user registers a new device, Twilio is the provider that sends the SMS text with a code for the user to put into Signal. Once they had compromised Twilio, attackers could initiate a Signal device swap, read the code from the SMS sent to the real account owner, and then take control of the Signal account. The secure messaging service said that the hackers targeted 1,900 of its users and explicitly searched for three. Among that tiny subset was the Signal account of Motherboard security reporter Lorenzo Franceschi-Bicchierai. Signal is built so the attackers could not have seen Franceschi-Bicchierai's message history or contacts by compromising his account, but they may have impersonated him and sent new messages from his account.

TechCrunch published an investigation in February into a group of spyware apps that all share backend infrastructure and expose targets’ data because of a shared vulnerability. The apps, which include TheTruthSpy, are invasive to begin with. But they're also inadvertently exposing the phone data of hundreds of thousands of Android users, TechCrunch reported, because of an infrastructure vulnerability. This week, though, TechCrunch published a tool victims can use to check whether their devices have been compromised with the spyware and take back control. “In June, a source provided TechCrunch with a cache of files dumped from the servers of TheTruthSpy’s internal network,” TechCrunch’s Zack Whittaker wrote. “That cache of files included a list of every Android device that was compromised by any of the spyware apps in TheTruthSpy’s network up to April 2022, which is presumably when the data was dumped. The leaked list does not contain enough information for TechCrunch to identify or notify owners of compromised devices. That’s why TechCrunch built this spyware lookup tool.”

Domain Logistics, a distribution company that works with the Ontario Cannabis Store (OCS) in Canada, was hacked on August 5, limiting OCS’s ability to process orders and deliver weed products to stores and customers around Ontario. OCS said there was no evidence that customer data had been compromised in the attack on Domain Logistics. OCS also says that cybersecurity consultants are investigating the incident. Customers in Ontario can order online from OCS, which is government-backed. The company also distributes to the roughly 1,330 licensed cannabis stores in the province. “Out of an abundance of caution to protect OCS and its customers, the decision was made to shut down Domain Logistics’ operations until a full forensic investigation could be completed,” OCS said in a statement.

Janet Jackson’s ‘Rhythm Nation’ Can Crash Old Hard Drives

A security researcher claims that Apple mobile devices keep connections open if they are created before a VPN is activated.

A security researcher says that Apple's iOS devices don't fully route all network traffic through VPNs as a user might expect, a potential security issue the device maker has known about for years.

Michael Horowitz, a longtime computer security blogger and researcher, puts it plainly—if contentiously—in a continually updated blog post. "VPNs on iOS are broken," he says.

Any third-party VPN seems to work at first, giving the device a new IP address, DNS servers, and a tunnel for new traffic, Horowitz writes. But sessions and connections established before a VPN is activated do not terminate and, in Horowitz's findings with advanced router logging, can still send data outside the VPN tunnel while it's active.

In other words, you might expect a VPN client to kill existing connections before establishing a secure connection so they can be reestablished inside the tunnel. But iOS VPNs can't seem to do this, Horowitz says, a finding that is backed up by a similar report from May 2020.

"Data leaves the iOS device outside of the VPN tunnel," Horowitz writes. "This is not a classic/legacy DNS leak, it is a data leak. I confirmed this using multiple types of VPN and software from multiple VPN providers. The latest version of iOS that I tested with is 15.6."

Privacy company Proton previously reported an iOS VPN bypass vulnerability that started at least in iOS 13.3.1. Like Horowitz's post, ProtonVPN's blog noted that a VPN typically closes all existing connections and reopens them inside a VPN tunnel, but that didn't happen on iOS. Most existing connections will eventually end up inside the tunnel, but some, like Apple's push notification service, can last for hours.

The primary issue with non-tunneled connections persisting is that they could be unencrypted and that the IP address of the user and what they're connecting to can be seen by ISPs and other parties. "Those at highest risk because of this security flaw are people in countries where surveillance and civil rights abuses are common," ProtonVPN wrote at the time. That might not be a pressing concern for typical VPN users, but it's notable.

ProtonVPN confirmed that the VPN bypass persisted in three subsequent updates to iOS 13. ProtonVPN indicated in its blog post that Apple would add functionality to block existing connections, but this functionality as added did not appear to make a difference in Horowitz's results.

Horowitz tested ProtonVPN's app in mid-2022 on an iPad iOS 15.4.1 and found that it still allowed persistent, non-tunneled connections to Apple's push service. The Kill Switch function added to ProtonVPN, which describes its function as blocking all network traffic if the VPN tunnel is lost, did not prevent leaks, according to Horowitz.

Horowitz tested again on iOS 15.5 with a different VPN provider and iOS app (OVPN, running the WireGuard protocol). His iPad continued to make requests to both Apple services and to Amazon Web Services.

ProtonVPN had suggested a workaround that was "almost as effective" as manually closing all connections when starting a VPN: Connect to a VPN server, turn on airplane mode, then turn it off. "Your other connections should also reconnect inside the VPN tunnel, though we cannot guarantee this 100%," ProtonVPN wrote. Horowitz suggests that iOS's Airplane Mode functions are so confusing as to make this a non-answer.

Ars Technica reached out to both Apple and OpenVPN for comment and will update this article with any responses.

Horowitz's post doesn't offer specifics on how iOS might fix the issue. He also doesn't address VPNs that offer "split tunneling," focusing instead on the promise of a VPN capturing all network traffic. For his part, Horowitz recommends a $130 dedicated VPN router as a truly secure VPN solution.

VPNs, especially commercial offerings, continue to be a complicated piece of internet security and privacy. Picking a "best VPN" has long been a challenge. VPNs can be brought down by vulnerabilities, unencrypted servers, greedy data brokers, or by being owned by Facebook.

_This story originally appeared on_ _Ars Technica__._

iOS Can Stop VPNs From Working as Expected—and Expose Your Data

This invasive malware isn’t just for phones—it can target your PC, too. But a new batch of algorithms aims to weed out this threat.

The surveillance-for-hire industry's powerful mobile spyware tools have gotten increasing attention lately as tech companies and governments grapple with the scale of the threat. But spyware that targets laptops and desktop PCs is extremely common in an array of cyberattacks, from state-backed espionage to financially motivated scams. Due to this growing threat, researchers from the incident response firm Volexity and Louisiana State University presented at the Black Hat security conference in Las Vegas last week new and refined tools that practitioners can use to catch more PC spyware in Windows 10, macOS 12, and Linux computers.

Widely used PC spyware—the type that often keylogs targets, tracks the movement of their mouse and clicks, listens in through a computer's microphone, and pulls still photos or video from the camera—can be difficult to detect because attackers intentionally design it to leave a minimal footprint. Rather than installing itself on a target's hard drive like a regular application, the malware (or its most important components) exists and runs only in the target computer's memory or RAM. This means that it doesn't generate certain classic red flags, doesn't show up in regular logs, and gets wiped away when a device is restarted. 

Enter the field of “memory forensics,” which is geared precisely toward developing techniques to assess what's going on in this liminal space. At Black Hat, the researchers specifically announced new detection algorithms based on their findings for the open source memory forensics framework Volatility. 

“Memory forensics was very different five or six years ago as far as how it was being used in the field both for incident response and by law enforcement,” Volexity director Andrew Case tells WIRED. (Case is also a lead developer of Volatility.) “It’s gotten to the point where even outside really intense malware investigations, memory forensics is needed. But for evidence or artifacts from a memory sample to be used in court or some type of legal proceeding, we need to know that the tools are working as expected and that the algorithms are validated. This latest stuff for Black Hat is really some hardcore new techniques as part of our effort to build out verified frameworks."

Case emphasizes that expanded spyware detection tools are needed because Volexity and other security firms regularly see real examples of hackers deploying memory-only spyware in their attacks. At the end of July, for example, Microsoft and the security firm RiskIQ published detailed findings and mitigations to counter the Subzero malware from an Austrian commercial spyware company, DSIRF.

“Observed victims \[targeted with Subzero\] to date include law firms, banks, and strategic consultancies in countries such as Austria, the United Kingdom, and Panama,” Microsoft and RiskIQ wrote. Subzero’s main payload, they added, “resides exclusively in memory to evade detection. It contains a variety of capabilities including keylogging, capturing screenshots, exfiltrating files, running a remote shell, and running arbitrary plugins.”

The researchers particularly focused on honing their detections for how the different operating systems talk to “hardware devices” or sensors and components like the keyboard and camera. By monitoring how the different parts of the system run and communicate with each other and looking for new behaviors or connections, memory forensic algorithms can catch and analyze more potentially malicious activity. One potential tell, for example, is to monitor an operating system process that’s always running, say the feature that lets users log in to a system, and to flag it if additional code gets injected into that process after it starts running. If code was introduced later it could be a sign of malicious manipulation.

“If you work in the incident response field, you likely see this malware all the time,” Case said during his Black Hat talk last week. “We see this targeted at our clients on a daily basis. And if you read the reports from other security vendors, it’s pretty much universal that when you have a motivated threat group targeting an organization—whether that’s a research group inside the organization, whether it’s executives, whether it’s down to just an individual person—the malware that gets deployed on those machines are going to leverage access to hardware devices for truly sensitive information.”

To do forensic analysis of what's happening in a device's memory at a given time, researchers dump the memory into a sort of snapshot file of everything that was in there at that moment. If your laptop has 16 GB of RAM and the memory is full, you'll pull out a 16-GB file from it. But to detect attacks in real time, organizations need to set up forensic monitoring on their devices in advance. And not all operating systems make it easy to conduct such monitoring.

Apple, in particular, is known for locking down access to macOS and iOS to minimize system visibility. The company says it takes this approach as a security measure because, in its estimation, users shouldn't need that level of access to operate within the tightly controlled Apple ecosystem. But the stance has been controversial for a number of reasons and has created tension with some security advocates, who say that when exploitable vulnerabilities do inevitably crop up in Apple's software, particularly iOS, the approach gives the hackers an advantage because defenders have more limited insight and control. 

“It can make exploitation harder, and it can make gaining malware persistence on a system harder,” Case says. “But it also makes forensics harder, so the argument goes both ways.” 

The team was able to make progress on developing detection tools for all three major desktop operating systems, though. And Case emphasizes that the goal is simply to detect as much spyware as possible wherever it can be done as the malware proliferates more and more.

“We work with a ton of very targeted organizations around the world and in the US, and it's organizations themselves being targeted. But also, many times, it’s individuals within the organization or within a political movement—these are the people who get targeted with this type of malware,” he says. “So the further we get on this research and the better our forensic tools are, the more we can find this behavior and make it harder for attackers to get into an environment, stay there, and get to data they want.”

Spyware Hunters Are Expanding Their Toolset

The best end-to-end encrypted messaging app has a host of security features. Here are the ones you should care about.

In times of uncertainty, people rightly often turn to the encrypted messaging app Signal. Whether it’s to protect sensitive conversations amid social unrest or to keep your communications private after the fall of _Roe v. Wade_, Signal represents most people’s best way to communicate safely. And thanks in part to a $50 million infusion in 2018 from Brian Acton, the former WhatsApp CEO and current interim Signal Foundation CEO, the once niche app is more accessible than ever.

Signal’s popularity often spikes in times of strife or when alternatives seem more precarious. In May 2020, as police brutality protests swept US cities, daily Signal downloads nearly tripled from their average, according to analytics company Apptopia. It saw another surge in January 2021 after WhatsApp, which end-to-end encrypts personal chats using the Signal Protocol, botched the messaging around a privacy policy update. Apptopia now estimates Signal has more than 600 million active monthly users. All of those people can take advantage of end-to-end encryption, which means that no one—not the government, their phone company, or Signal itself—can read the contents of messages as they pass between devices.

Signal is not the only messaging app to offer end-to-end encryption; iMessage has it, as do stand-alone apps like Telegram. But Signal stands apart, both for its rich features and the fact that its code has been open source for years, meaning cryptographers have had plenty of opportunities to poke and prod it for flaws.

WIRED has long encouraged readers to adopt Signal. Here, we’re offering tips on how to get the most out of it once you do.

_Updated August 2022: Signal has added a few new features since we first ran this story, which are now reflected below._

Know Its Limits

For those who are new to encrypted messaging, the most important thing to remember is that it’s not magic. Having Signal on your phone does not make you invincible. Nearly 2,000 users found that out the hard way this month. Signal uses communications firm Twilio to verify users’ phone numbers and send out device registration codes via SMS messages. So when attackers successfully breached Twilio through a recent phishing campaign, they were able to access those SMS codes for some 1,900 Signal accounts and potentially register a victim’s phone number with their own device.

Signal says all affected users “can rest assured that their message history, contact lists, profile information, whom they’d blocked, and other personal data remain private and secure and were not affected.” But the attackers were able to take over at least one account and pose as that person on Signal. It’s a potent reminder that even an app that’s designed around security can have weak spots.

Most importantly, remember that if you’re messaging with someone who doesn’t have Signal installed, nothing’s encrypted. It only works for Signal-to-Signal communications. And make sure you have a strong password on your phone in the first place, since anyone who has physical access to your device can still read your messages.

Signal also has a desktop app, which should be plenty secure for the vast majority of people; just be aware that desktop environments face a litany of threats. And using Signal on multiple devices means more places your messages can be compromised or stolen.

Get Set Up Safely

When you join, Signal requires you to provide a phone number that essentially serves as your user name. This doesn’t mean you have to use your actual phone number, though. To avoid giving it up, use a Google Voice number instead.

To do so, head to Google Voice in your browser, log in with a Google account, and select a new phone number. Google will ask you to verify it by providing your actual phone number, where it’ll send a code that will let you complete your registration. You can now use that Google Voice number for your Signal account, keeping it separate from your main line. (Heads up: If you don't place a call or receive a single text to your Google Voice number every six months, Google will reclaim that number. If that happens, you can get it back within 45 days. So make sure to shoot your Google Voice number a text at least once every few months.)

You should feel comfortable letting Signal access your device’s contacts; it stores that information on your phone, not in the cloud. The app does periodically send truncated, hashed phone numbers back to Signal’s servers, which is how it checks if any of your contacts are also using it, but the company also says it discards that information “immediately.” That way, the app can alert you when one of your contacts signs up for Signal; if you’d rather not get those updates, tap **Settings**, then **Notifications**, and toggle off **Contact Joined Signal**.

(Note: Android users can access Signal’s **Settings** menu either by tapping their profile icon or selecting the menu under the three dots in the upper-right corner, then tapping **Settings**. iOS users will need to tap their profile icon and then Settings to access the full menu.)

On Android, you can make Signal your default messaging app by going to **Settings** > **Apps & notifications** > **Advanced** > **Default Apps** > **SMS app**, and picking **Signal**. Just remember that not everyone you text has it installed and that an iOS user you’re texting with might check their Signal app less often than they do iMessage. (iOS still doesn’t let you change the default messaging app, sorry!)

One of the most critical settings to enable is profile PINs, which will make it easier for you to keep your account data even when you transfer devices and to protect your contact lists, profile information, settings, and more. You can set one up when you join or head to **Privacy** > **Signal PIN** in your app settings to set or change yours anytime. The introduction of PINs was controversial among cryptography hard-liners, who questioned whether the so-called Secure Value Recovery they were tied to introduced potential vulnerabilities. It didn’t help that Signal had at first made the PINs mandatory. You can opt out now by going to the **Create PIN** screen and tapping **Select more**, then **Disable PIN**. Just remember that if you do so, you won’t be able to bring your contacts with you to a new device, and sensitive account information may be more vulnerable.

Lastly, once you have your PIN set up, enable **Registration Lock** by going to **Settings** > **Account** and toggling on **Registration Lock**. With this feature enabled, attackers won’t be able to take over your account and register it to a new device in the way they did through the Twilio hack mentioned above.

Protect Your Screen

It’s important to make sure that what happens in Signal stays in Signal. This means keeping people from seeing what you’re doing there from a lock screen or when switching apps. There’s not much point in having an app for sensitive messages if they just pop up on your display whenever you receive one.

To turn off Signal lock screen notifications on iOS, go to your phone’s **Settings** > **Notifications**, then scroll down and tap **Signal** > **Show Previews** > **Never**. On Android, the process is similar. From your home screen, head to **Settings**, then **Apps & Notifications**, where you can turn off all notifications. If you need more granular control, you can find that in the Signal app itself, where the steps are the same no matter what platform you’re on. Tap your profile, then **Notifications**, then **Show**, where you can choose whether to display the name, content, and actions for an incoming text; just the name; or nothing at all. You can also mute notifications for a specific conversation for a set amount of time by tapping on a message thread, then the contact header, and then **Mute**. You can silence a contact’s notifications for an hour, a day, a week, or a year.

If you’re on Android and want to enable Signal notifications, you may want to disable smart replies by going to **Settings** > **Apps & Notifications** > **Notifications** > **Advanced** and making sure “**Suggested actions and replies**” are turned off. Google says it keeps smart replies private by processing them locally on your device, but the safest bet is to limit Signal’s interactions with the rest of the operating system.

Signal also has a Screen Lock feature that requires your password—or FaceID or TouchID, whatever you use to get into your phone—to view the app’s contents. Within the Signal app on either platform, tap your profile, then **Privacy**, then toggle the **Screen Lock** option to on. Android gives you a little more granularity, with a **Screen Lock Inactivity Timeout** option that lets you set the feature to kick in after a certain amount of time. 

You’ll also want to enable **Screen Security**, which keeps Signal contents from showing up in your app switcher. On Android, select your profile, then **Privacy**, and switch on **Screen Security**. If you use iOS, go to your profile, tap **Settings** > **Privacy**, and enable **Hide Screen in App Switcher**.

Make Messages Disappear

While you can always delete messages manually along the way, that action only applies to your own phone. The people you’re chatting with still have it on their devices. To ensure that the conversation is deleted on both ends of a thread, you should embrace “disappearing messages” instead.

Signal now allows you to enable disappearing messages on all new chats by default, which we highly recommend. Go to **Settings** > **Privacy** > **Default Timer for New Chats**, and select the length of time you want your messages to disappear by default. You can choose preset options ranging from 30 seconds to four weeks, or set whatever custom time you like. Note that enabling this setting only applies to new chats and won’t override the settings for chats you were in before turning it on.

You can also tweak your disappearing message settings for individual chats. From within a chat, tap on the name of your contact. Toggle over **Disappearing Messages** and set the amount of time you want them to be live before they vanish. A timer icon will show up in your thread; either of you can change the disappearing time by tapping on it and adjusting it as needed. That’s also how you can disable disappearing messages altogether within a particular chat.

It’s a handy feature, but a quick reminder that people can still screenshot your conversations to keep a record, so don’t assume they’re gone forever—especially if you don’t trust whoever’s on the other end of the line.

Place an Encrypted Call

Signal’s not just for messages; you can make end-to-end encrypted voice and video calls from the app as well. To do so, just tap the pencil icon within the app like you would to start a chat. Pick a contact, then select either the video icon or phone icon, depending on which type of call you’d like to make.

Signal also now allows group video calls. If you already have a group created, tap on the chat, then select the video icon. If you want to create a new group, select the **pencil icon** > **New Group**, select the contacts you’d like to include, and tap **Next**. Give your group a name, and hit **Create**. Then tap the video icon.

An important note here: If you do make calls from Signal on iOS, make sure to first head to **Privacy** within the app and toggle off **Show Calls in Recents**. Otherwise, your Signal call history will sync with iCloud, creating an unnecessary record of your conversation. And if you’re extra cautious, go to **Settings** > **Privacy** and toggle on **Always Relay Calls**; that’ll route your calls through Signal’s servers and hide your IP address in the process.

Send Photos and Videos

As with other messaging apps, you can use Signal to send photos and videos—with a privacy-friendly media feature that sets it apart.

First things first: If you take a photo from within Signal—just tap the camera icon either from your contact list or within a chat—it doesn’t automatically save to your camera roll, which means it doesn’t get backed up to your cloud photo library. That’s good! The fewer ways you can accidentally leave a trail, the better. If you want to keep an image for posterity, you can tap the save icon in the upper right corner. Otherwise, just send it and move on.

You can also make sure that your photo and video don’t stay on the recipient’s device long. Before you hit send, note the infinity icon next to the chat bubble. That means the media you’re about to share can be viewed indefinitely. Tap it once, though, and it’ll switch to a **1x**, meaning that the photo or video will disappear from the conversation as soon as it’s been viewed. A record will remain in the thread that media was shared, but the image itself will no longer be visible.

Extra Measures

This list is not 100 percent comprehensive. Some features are too minor to mention; others are intended for niche use cases. But there are a few other stray tips that might be helpful to know as you get used to using Signal.

**Read Receipts:** Some people feel strongly about these! If you’re one of them, head to **Settings** > **Privacy** and toggle them off when you’re in the app.

**Stickers:** As part of its long-term quest to find broad appeal, Signal recently added a limited selection of stickers to liven up your secret chats. (Incorporating them required some tricky encryption itself.) Just tap the sticker icon in the chat compose window to peruse your options.

**Emoji Reactions:** Similarly, Signal finally expanded its emoji reaction options in June 2020. From seven basic choices, the app broadened the palette to a full range of faces, animals, foods, buildings, and yes, smiling poop. To add a reaction, just hold down on the response, then tap the three horizontal dots to access the full keyboard.

**Block Party:** Block! Block! Block! Block! To shut down unwanted conversations, either tap on the user’s name from within a chat and toggle over **Block This User**, or strike preemptively by tapping your profile icon, then **Privacy** > **Blocked** > **Add Blocked User**, and then the party you don’t want to hear from.

**Message Requests:** As of August 2020, you can also approve or block other Signal users when they first reach out to you, without their knowing that you’ve seen their incoming message or call. If you do block someone, they won’t get any indication other than remaining in limbo. And the feature also blocks strangers from adding you to group chats, a popular spammer tactic. It’s similar to what you’ve likely already experienced in Facebook Messenger or Twitter direct messages and will be increasingly useful as Signal’s user base expands.

**Private Type:** On Android, third-party keyboard apps can retain a record of what you type and swipe; not ideal when you’re trying to send private messages. Under **Privacy**, go ahead and toggle on **Incognito Keyboard** to keep them in the dark.

**Change your number:** If you get a new phone number or want to change the number you use with your Signal account, the app now allows you to do so without losing everything. The feature doesn’t work in all situations or with every version of the app or operating system, so check the details here.

That should be enough to get you started! Just remember, as you get used to the advanced settings and figure out what combination of disappearing messages and screen locking works for you, that you’ve already taken the most important step of all: downloading Signal in the first place.

How to Use Signal Encrypted Messaging

The Freedom of Information Act helps Americans learn what the government is up to. The Poseys exploited it—and became unlikely defenders of transparency.

The Family That Mined the Pentagon's Data for Profit

Google’s new mobile operating system has arrived. Take back some control with these privacy and security tips.

It's late summer in the northern hemisphere, which means new phone operating systems are coming. In a few weeks, Apple will release iOS 16 to millions of iPhones and iPads around the world. Google, meanwhile, has already made the latest version of Android available—on some phones you can now download Android 13.

The newest version of the Android operating system is more “evolution than revolution,” with the majority of changes smaller than in previous iterations. But Android’s security team is trying to simplify people’s privacy options throughout Android 13. This version of the OS involves changes under the hood for app developers and some streamlined security options for users.

You probably don’t spend a lot of time thinking about the privacy and security settings on your phone. However, whenever you download a new operating system, it’s worth spending a few minutes scrolling and tapping through all the options you haven’t touched in the past 12 months. Here’s what you should take a look at on Android 13.

Clamp Down on App Permissions

In Android 12, Google introduced “nearby device” permissions. This was designed to stop your headphones app from requesting your precise location when it was trying to wirelessly connect to your headphones. Android 13 expands on these controls to stop apps from using Wi-Fi permissions to collect your location data. In their code, app developers have to specify that they will never use Wi-Fi APIs to access location information.

Android’s **Privacy dashboard** has also been updated. The dashboard, which can be accessed through **Settings >** **Privacy**, shows the permissions you have given apps to use—this includes the apps that can access your camera, contacts, and multiple other sensors and types of data. It will now show which apps have used each permission over the past seven days, rather than just 24 hours.

Some of the privacy changes in Android 13 don’t require you to do anything, but it is worth knowing about them anyway. For instance, the OS will start deleting your clipboard history automatically after a short period of time so that apps don’t snoop on the information you previously copied. Also, from now on, apps that use Google’s advertising ID, which is a unique code assigned to your device, must declare the ad ID permission in their documentation. “If your app does not declare this permission when targeting Android 13 or higher, the advertising ID is automatically removed and replaced with a string of zeroes,” Google says.

Photo Picker

When you want to use a photo you’ve taken in another app—for instance, as a Twitter profile photo or to share images with friends—your device uses Photo Picker. This loads up a screen that includes the photos on your device and gives you the option to use them in the app you’re in. The new privacy changes in Android 13 mean you won’t automatically give an app access to all your photos and videos. Instead, the photo picker will now only give the app access to the photos you allow it.

In addition, Android’s developer pages state that if apps want to use images, audio, or video that other apps have created, they must explicitly say the type of files they want access to and give you clear prompts that this will happen.

More Notification Control

Few things are more infuriating than apps that send a constant barrage of notifications. And there are some notifications you may not want appearing on your screen for anyone nearby to see. While it has been possible to control app notifications for some time, Android 13 is making it easier to do so from the outset. Now, when you open up an app for the first time or use it for the first time in a while, you’ll be asked if you want it to send you notifications. Spammy notifications, be gone.

Other Security and Privacy Options

While you’re thinking about your phone’s privacy settings, it’s worth taking some time to flick through your device’s other options to boost your overall protection. It’s possible there are previous changes that you’ve missed. The vast majority of the settings below can be changed by visiting **Settings** on your Android and then following the specific options.

In the **Security** section, Android provides you with an overview of your device’s status. It will show you when the last security update was applied, let you set a screen lock and fingerprint or biometric unlocking (if your device supports them), and let you go through Google’s wider security checkup that looks at the current state of your accounts. (Later this year, Android will introduce a new **Security & privacy** option that will put all of these settings in one place.)

In the **Privacy** menu, there are a few things you should change. The **Privacy dashboard**, as described above, will show you which apps have used which sensors and data on your phone in the past seven days. After looking at this, you should tap on **Permission manager**, where you’ll be presented with all the sensors and types of data that your phone can give to apps. These range from your location and camera access to your calendar and files. You should look through each of the permissions and decide if an app really needs access to them to function.

Next in **Privacy**, you should open **Google location history** and **Activity controls**. Both of these options are linked to your wider Google account(s), but the settings here allow you to control what data Google keeps about you—it’s a lot. Using these options, you can wipe your web and activity data, the locations Google keeps on your movements, and details such as YouTube search history.

Then head to **Privacy** and **Ads**. Here you can use **Reset advertising ID** to change the ID Google has assigned to your phone. This advertising ID is used by apps and advertisers across the web to track your interests and show you potentially creepy personalized advertising. As well as resetting your ad ID, there’s an option to **Delete advertising ID**, meaning “apps can no longer use this advertising ID to show you personalized ads.”

Finally, while you’re thinking about your digital privacy and security, you should make sure you are using a password manager to protect your online life and using multi-factor authentication wherever possible.

The Android 13 Privacy Settings You Should Update Now

Keep private photos, videos, and documents away from prying eyes.

The lock screen on your smartphone is an essential barrier to anyone looking to gain access to the device: It stops people from getting at your data, your social media accounts, your banking apps, and everything else.

However, you may well want to add a second barrier to entry for anyone who gets past your lock screen—whether it’s friends or relatives who have borrowed your phone, or someone more sinister who’s managed to work out how to bypass the lock screen.

In those situations, a secure folder can protect your most important files—such as photos or documents—from prying eyes, requiring another authentication method such as a PIN code or a recognized fingerprint before it will open up.

There are options built into Android and iOS, as well as third-party apps you can turn to if you want to set up a secure folder of some sort on your smartphone.

If You’re Using an Android Phone

The good news if you’re using a midrange or premium Samsung Galaxy handset is that there’s a Secure Folder feature built in. To enable it, go to Settings and choose **Biometrics and Security**, then **Secure Folder**: You’ll be prompted to create a Samsung account or sign into an existing one, and then you’ll be able to choose your lock method. You can protect the folder with a pattern, PIN, password, or fingerprint scan.

The Secure Folder appears on the home screen by default, though you can hide it through the same **Secure Folder** menu in Settings—no one else will be able to get into that folder without the login method you’ve specified. When you’re in the Secure Folder, you can add files by tapping the **+** (plus) button.

Samsung makes its own Secure Folder app.

Samsung via David Nield

Another way to get files into your Secure Folder is from the apps they're already in. In the Samsung Gallery app, for example, you can select one or more images, tap the **More** button in the lower right corner, then pick **Move to Secure Folder**. If you need to delete your Secure Folder, go back to the **Secure Folder** menu in Settings.

Other options on Android are available, but the best one depends on what you want to protect. If you want to lock away sensitive photos and videos in Google Photos, for example, the feature is built right in: From the app, pick **Library**, **Utilities**, then **Get Started** under **Locked Folder**. Follow the instructions, which will involve entering your screen lock code.

Images and videos in the Locked Folder won’t show up in searches or on other screens, and aren’t backed up to the cloud. You can send files straight there from the Google Camera app (gallery icon top right, then **Locked Folder**) or from the photo gallery in Google Photos (select your items, tap **More**, then **Move to Locked Folder**).

Google Photos comes with a Locked Folder feature.

Google via David Nield

If none of those options cover your needs, there are plenty of third-party options available, as you would expect. For example, OneDrive for Android has a Personal Vault space that needs an extra level of authentication to access, though you’ll need to pay Microsoft for some cloud storage space if you want to save more than three files in it.

There’s also the free Norton App Lock, which takes a slightly different approach. It lets you lock away entire apps behind a passcode—not only protecting your files from unwanted access but locking away entire apps. It’s also a handy app to have around if you’re regularly lending your phone to other people and want to control which parts of the device they have access to.

If You’re Using an iPhone

The iPhone doesn’t have any kind of secure-folder functionality integrated into its iOS software, but there is a Hidden folder inside the Photos app that you can move private photos and videos to. Select any item in one of the Photos app galleries, tap on the **Share** button (the arrow pointing out of a square), and choose **Hide** to do just that.

At the time of writing, this isn’t really all that effective a protection method, because anyone can just go to **Albums** and **Hidden** to see what you’ve put there. However, with the arrival of iOS 16 (which we’re expecting in September 2022 or thereabouts), this folder will need to be unlocked with a passcode, Touch ID, or Face ID.

The iOS Notes app works in a similar way to a secure folder.

Apple via David Nield

Another option is to use the Notes app, which lets you lock individual notes with text, images, and videos inside them. First, go to Settings on iOS, then choose **Notes** and **Password** to set a password specifically for the Notes app. Once that’s done, you can lock a note and put it behind the password you’ve configured by opening the note, tapping the three dots at the top, then choosing **Lock**.

Other than that, you’re relying on a third-party app to do the job for you—and you can try OneDrive, as we mentioned in the Android section. The Personal Vault section comes with another layer of security on top, so even if someone gets into the OneDrive app, they won’t be able to access that folder in particular without extra authentication.

Folder Lock is straightforward enough, giving you a sealed-off section of your iPhone that no one else can get inside without the right credentials—you can save notes, videos, images, documents, and audio files, though some of the more advanced features require a $4 upgrade fee.

MaxVault is one of the third-party apps on iOS you can try.

MaxVault via David Nield

Best Secret Folder is perhaps even simpler to use, and gives you a password-protected place to lock away photos and videos that you don’t want anyone else to see. You get a decent number of options for organizing said photos and videos, and you can even check on failed login attempts should you suspect that someone is trying to get at your files without your permission. It’s free to try, with various paid options for removing ads and unlocking additional features.

Lastly, MaxVault is also worth a look. You can keep a wealth of data in your PIN-protected MaxVault folder, including photos, videos, documents, and passwords—and getting items into your folder only takes a couple of taps. There’s even a privacy-focused web browser included that you can make use of, and it also alerts you if someone else tries to get at your data. Some of the features require a premium upgrade, which will cost you $4 a month.

Source

Wired