Ten years after it was first unveiled, the powerful firmware analysis platform Ofrak is now available to anyone.

At the 2012 DefCon security conference in Las Vegas, Ang Cui, an embedded device security researcher, previewed a tool for analyzing firmware, the foundational software that underpins any computer and coordinates between hardware and software. The tool was specifically designed to elucidate internet-of-things (IoT) device firmware and the compiled “binaries” running on anything from a home printer to an industrial door controller. Dubbed FRAK, the Firmware Reverse Analysis Console aimed to reduce overhead so security researchers could make progress assessing the vast and ever-growing population of buggy and vulnerable embedded devices rather than getting bogged down in tedious reverse engineering prep work. Cui promised that the tool would soon be open source and available for anyone to use.

“This is really useful if you want to understand how a mysterious embedded device works, whether there are vulnerabilities inside, and how you can protect these embedded devices against exploitation,” Cui explained in 2012. “FRAK will be open source very soon, so we’re working hard to get that out there. I want to do one more pass, internal code review before you guys see my dirty laundry.”

He was nothing if not thorough. A decade later, Cui and his company, Red Balloon Security, are launching Ofrak, or OpenFRAK, at DefCon in Las Vegas this week.

“In 2012 I thought, here’s a framework that would help researchers move embedded security forward. And I went on stage and said, I think the community should have it. And I got a number of emails from a number of lawyers,” Cui told WIRED ahead of the release. “Embedded security is a space that we absolutely need to have more good eyes and brains on. We needed it 10 years ago, and we finally found a way to give this capability out. So here it is.”

Though it hadn’t yet fulfilled its destiny as a publicly available tool, FRAK hasn’t been languishing all these years either. Red Balloon Security continued refining and expanding the platform for internal use in its work with both IoT device makers and customers who need a high level of security from the embedded devices they buy and deploy. Jacob Strieb, a software engineer at Red Balloon, says the company always used FRAK in its workflow, but that Ofrak is an overhauled and streamlined version that Red Balloon itself has switched to.

Cui’s 2012 demo of FRAK raised some hackles because the concept included tailored firmware unpackers for specific vendors’ products. Today, Ofrak is simply a general tool that doesn’t wade into potential trade secrets or intellectual property concerns. Like other reverse engineering platforms, including the NSA’s open source Ghidra tool, the stalwart disassembler IDA, or the firmware analysis tool Binwalk, Ofrak is a neutral investigative framework. And Red Balloon’s new offering is designed to integrate with these other platforms for easier collaboration among multiple people.

“What makes it unique is it’s designed to provide a common interface for other tools, so the benefit is that you can use all different tools depending on what you have at your disposal or what works best for a certain project,” Strieb says.

The platform is also unusual for offering advanced, automated repacking mechanisms for firmware binaries. Most reverse engineering tools aid in unpacking but lack extensive repacking capabilities, because even small modifications you make to firmware can incidentally break functionality or change how the program behaves. Repacking was always a core part of how Cui conceived FRAK, though, and Red Balloon has continued to improve it over the years for the company’s own work.

When Cui gave his original FRAK presentation, the project already had support from a now-concluded Defense Advanced Research Projects Agency program. Known as Cyber Fast Track, the DARPA initiative was run by security researcher Peiter Zatko, better known as Mudge.

“The proposal was compelling enough for me to fund it in April 2012, and I worked extremely hard to ensure I was a good steward of such funding,” Mudge says. “This is a valuable tool that significantly facilitated security researchers’ work in the field of applied embedded security. I am very happy to see more of this project being made available to such a wide audience through open source.”

After the end of Cyber Fast Track in 2013, Ofrak continued to receive partial support from DARPA’s Assured Micropatching program.

“Oftentimes, it’s cost prohibitive for organizations to hire reverse engineers with specialized skills to patch embedded devices,” says Sergey Bratus, a DARPA program manager. “A key goal of the AMP program is to make this capability readily available through automation. Automating the application of a fix turns out to be a hard computer science problem with fundamental research challenges. These challenges must be supported with new classes of modular, community-building, research-enabling tools such as Ofrak.”

In other words, Ofrak is not only useful for independent researchers who want to penetrate the black box of embedded devices. It can also help manufacturers assess their own products and play a role in patch development and distribution, a longtime challenge and frequent debacle in IoT.

Red Balloon’s Strieb says the company hopes Ofrak will be widely adopted and that people will develop add-on modules for community use. Red Balloon plans to maintain the tool long-term, and says it is fully committed to keeping licenses for personal use and research free in perpetuity. 

For Cui, it all fits into his original FRAK vision from 10 years ago.

“If more people looked inside the things and realized they could change the things, we would have more secure embedded devices,” he says. “So please take Ofrak, realize you have the power to reason about and change the code running on these devices, and then there’s a whole world of things you can create that are better than what we have now.”

A Long-Awaited IoT Reverse Engineering Tool Is Finally Here

It cost a researcher only $25 worth of parts to create a tool that allows custom code to run on the satellite dishes.

Since 2018, Elon Musk’s Starlink has launched more than 3,000 small satellites into orbit. This satellite network beams internet connections to hard-to-reach locations on Earth and has been a vital source of connectivity during Russia’s war in Ukraine. Thousands more satellites are planned for launch as the industry booms. Now, like any emerging technology, those satellite components are being hacked.

Today, Lennert Wouters, a security researcher at the Belgian university KU Leuven, will reveal one of the first security breakdowns of Starlink’s user terminals, the satellite dishes (dubbed Dishy McFlatface) that are positioned on people’s homes and buildings. At the Black Hat security conference in Las Vegas, Wouters will detail how a series of hardware vulnerabilities allow attackers to access the Starlink system and run custom code on the devices.

To access the satellite dish’s software, Wouters physically stripped down a dish he purchased and created a custom hacking tool that can be attached to the Starlink dish. The hacking tool, a custom circuit board known as a modchip, uses off-the-shelf parts that cost around $25. Once attached to the Starlink dish, the homemade printed circuit board (PCB) is able to launch a fault injection attack—temporarily shorting the system—to help bypass Starlink’s security protections. This “glitch” allows Wouters to get into previously locked parts of the Starlink system.

Wouters is now making his hacking tool open source on GitHub, including some of the details needed to launch the attack. “As an attacker, let’s say you wanted to attack the satellite itself,” Wouters explains, “You could try to build your own system that allows you to talk to the satellite, but that’s quite difficult. So if you want to attack the satellites, you would like to go through the user terminal as that likely makes your life easier.”

The researcher notified Starlink of the flaws last year and the company paid Wouters through its bug bounty scheme for identifying the vulnerabilities. Wouters says that while SpaceX has issued an update to make the attack harder (he changed the modchip in response), the underlying issue can’t be fixed unless the company creates a new version of the main chip. All existing user terminals are vulnerable, Wouters says.

Starlink says it plans to release a “public update” following Wouters’ presentation at Black Hat this afternoon, but declined to share any details about that update with WIRED prior to publication.

Starlink’s internet system is made up of three major parts. First, there are the satellites that move in low Earth orbit, around 340 miles above the surface, and beam down connections to the surface. The satellites communicate with two systems on Earth: gateways that send internet connections up to the satellites, and the Dishy McFlatface dishes people can buy. Wouters’ research focuses on these user terminals, which originally were round, but newer models are rectangular.

There have been multiple teardowns of Starlink’s user terminals since the company started selling them. Engineers on YouTube have opened up their terminals, exposing their components and how they work. Others discuss the technical specs on Reddit. However, Wouters, who previously created hardware that can unlock a Tesla in 90 seconds, looked at the security of the terminal and its chips. “The user terminal was definitely designed by capable people,” Wouters says.

His attacks against the user terminal involved multiple stages and technical measures before he finally created the now open source circuit board that can be used to glitch the dish. Broadly, the attack using the custom circuit board works by bypassing signature verification security checks, which look to prove that the system is launching correctly and hasn’t been tampered with. “We’re using this to accurately time when to inject the glitch,” Wouters says.

Starting in May 2021, Wouters began testing the Starlink system, getting 268-Mbps download speeds and 49-Mbps upload speeds on his university building’s roof. Then it was time to open the device up. Using a combination of a “heat gun, prying tools, isopropyl alcohol, and a lot of patience,” he was able to remove the large metal cover from the dish and access its internal components.

Photograph: Lennert Wouters

Under the 59-cm diameter hood is a large PCB that houses a system-on-chip, including a custom quad-core ARM Cortex-A53 processor, the architecture of which isn’t publicly documented, making it harder to hack. Among other items on the board are radio frequency equipment, power over ethernet systems, and a GPS receiver. Opening up the dish allowed Wouters to understand how it boots up and download its firmware.

To design the modchip, Wouters scanned the Starlink dish and created the design to fit over the existing Starlink board. The modchip requires soldering to the existing Starlink PCB and connecting it using a few wires. The modchip itself is made up of a Raspberry Pi microcontroller, flash storage, electronic switches, and a voltage regulator. When creating the user terminal’s board, Starlink engineers printed “Made on Earth by humans” across it. Wouters’ modchip reads: “Glitched on Earth by humans.”

To get access to the dish’s software, Wouters used his custom system to bypass security protections by using the voltage fault injection attack. When the Starlink dish is turning on, it uses a series of different bootloader stages. Wouters’ attack runs the glitch against the first bootloader, known as the ROM bootloader, which is burned onto the system-on-chip and can’t be updated. The attack then deploys patched firmware on later bootloaders, which allows him to take control of the dish.

“From a high-level view, there are two obvious things that you could try to attack: the signature verification or the hash verification,” Wouters says. The glitch works against the signature verification process. “Normally you want to avoid shorts,” he says. “In this case we do it on purpose.”

Initially, Wouters attempted to glitch the chip at the end of its boot cycle—when the Linux operating system has fully loaded—but ultimately found it easier to cause the glitch at the start of the boot. This way was more reliable, Wouters says. To get the glitch to work, he says, he had to stop decoupling capacitors, which are used to smooth out the power supply, from operating. Essentially, the attack disables the decoupling capacitors, runs the glitch to bypass the security protections, and then enables the decoupling capacitors.

This process allows the researcher to run a patched version of Starlink’s firmware during the boot cycle and ultimately allows access to its underlying systems. In response to the research, Wouters says, Starlink offered him researcher-level access to the device’s software, although he says he declined as he had gone too deep with the work and wanted to build the modchip. (During testing, he hung the modified dish out of this research lab’s window and used a plastic bag as a makeshift waterproofing system.)

Starlink also issued a firmware update, Wouters says, that makes the attack harder, but not impossible, to execute. Anyone wanting to break into the dish in this way would have to put a lot of time and effort into doing so. While the attack isn’t as devastating as being able to take down satellite systems or connectivity, Wouters says it can be used to learn more about how the Starlink network operates.

“What I am working on now is communicating with the backend servers,” Wouters explains. Despite making the details of the modchip available for download on Github, Wouters does not have any plans to sell finished modchips, nor is he providing people with patched user terminal firmware or the exact details of the glitch he used.

As an increasing amount of satellites are launched—Amazon, OneWeb, Boeing, Telesat, and SpaceX are creating their own constellations—their security will come under greater scrutiny. In addition to providing homes with internet connections, the systems can also help to get ships online, and play a role in critical infrastructure. Malicious hackers have already shown that satellite internet systems are a target. As Russian troops invaded Ukraine, alleged Russian military hackers targeted the Via-Sat satellite system, deploying wiper malware that bricked people’s routers and knocked them offline. Around 30,000 internet connections in Europe were disrupted, including more than 5,000 wind turbines.

“I think it’s important to assess how secure these systems are because they are critical infrastructure,” Wouters says. “I don’t think it's very far-fetched that certain people would try to do this type of attack because it is quite easy to get access to a dish like this.”

_Update 5 pm ET August 10, 2022:_ After Wouters’ conference talk, Starlink published a six-page PDF explaining how it secures its systems. “We find the attack to be technically impressive, and is the first attack of its kind that we are aware of in our system,” the paper says. “We expect attackers with invasive physical access to be able to take malicious actions on behalf of a single Starlink kit using its identity, so we rely on the design principle of ‘least privilege’ to constrain the effects in the broader system.”

Starlink reiterates that the attack needs physical access to a user terminal and emphasizes its secure boot system, which was compromised by the glitching process, is only impacted on that one device. Wider parts of the overall Starlink system are not impacted. “Normal Starlink users do not need to be worried about this attack affecting them, or take any action in response,” Starlink says.

The Hacking of Starlink Terminals Has Begun

New research found troubling vulnerabilities in the 5G platforms carriers offer to wrangle embedded device data.

True 5G wireless data, with its ultrafast speeds and enhanced security protections, has been slow to roll out around the world. As the mobile technology proliferates—combining expanded speed and bandwidth with low latency connections—one of its most touted features is starting to come into focus. But the upgrade comes with its own raft of potential security exposures.

A massive new population of 5G-capable devices, from smart city sensors to agriculture robots and beyond, are gaining the ability to connect to the internet in places where Wi-Fi isn't practical or available. Individuals may even elect to trade their fiber optic internet connection for a home 5G receiver. New research that will be presented on Wednesday at the Black Hat security conference in Las Vegas, though, warns that the interfaces carriers have set up to manage internet of things data are riddled with security vulnerabilities they fear will dog the industry long term.

After years of examining potential security and privacy issues in mobile data radio frequency standards, Technical University of Berlin researcher Altaf Shaik says he was curious to investigate the application programming interfaces (APIs) carriers are offering to make IoT data accessible to developers. These are the conduits applications can use to pull, say, real-time bus tracking data or information about stock in a warehouse. Such APIs are ubiquitous in web services, but Shaik points out that they haven't been widely used in core telecommunications offerings. Looking at the 5G IoT APIs of 10 mobile carriers around the world, Shaik and his colleague Shinjo Park found common, widely-known API vulnerabilities in all of them, and some could be exploited to gain authorized access to data or even direct access to IoT devices on the network.

“There's a big knowledge gap, this is the beginning of a new type of attack in telecom,” Shaik told WIRED ahead of his presentation. “There's a whole platform where you get access to the APIs, there’s documentation, everything, and it's called something like ‘IoT service platform.’ Every operator in every country is going to be selling them if they're not already, and there are virtual operators and subcontracts, too, so there will be a ton of companies offering this kind of platform.”

The designs of IoT service platforms aren’t specified in the 5G standard and are up to each carrier and company to create and deploy. That means there's widespread variation in their quality and implementation. In addition to 5G, upgraded 4G networks can also support some IoT expansion, widening the number of carriers that may offer IoT service platforms and the APIs that feed them.

The researchers bought IoT plans on the 10 carriers they analyzed and got special data-only SIM cards for their networks of IoT devices. This way they had the same access to the platforms as any other customer in the ecosystem. They found that basic flaws in how the APIs were set up, like weak authentication or missing access controls, could reveal SIM card identifiers, SIM card secret keys, the identity of who purchased which SIM card, and their billing information. And in some cases, the researchers could even access large streams of other users' data or even identify and access their IoT devices by sending or replaying commands that they shouldn’t have been able to control.

The researchers went through disclosure processes with the 10 carriers they tested and said that the majority of vulnerabilities they found so far are being fixed. Shaik notes that the quality of security protections on the IoT service platforms varied widely, with some appearing more mature while others were “still sticking to the same old, bad security policies and principles.” He adds that the group isn't publicly naming the carriers they looked at in this work because of concerns about how widespread the issues might be. Seven of the carriers are based in Europe, two are in the United States, and one is in Asia.

“We found vulnerabilities that could be exploited to access other devices even though they don’t belong to us, just by being on the platform,” Shaik says. “Or we could talk to other IoT devices and send messages, extract information. It’s a big issue.”

Shaik emphasizes that he and his colleagues didn’t hack any other customers or do anything improper once they discovered the different flaws. But he points out that none of the carriers detected the researchers’ probing, which in itself indicates a lack of monitoring and safeguards, he says.

The findings are just a first step, but they underscore the challenges of securing massive new ecosystems as the full breadth and scale of 5G starts to appear on the horizon.

One of 5G's Biggest Features Is a Security Minefield

The fact that a search of Donald Trump's Florida home was even necessary says a lot.

Very few people ever find themselves on the receiving end of an FBI search warrant—even fewer end up escaping criminal charges.

The fact that Donald Trump now ranks among the former provides the strongest indication yet that he may soon face the latter.

Monday’s search of the former president’s Mar-a-Lago property in Florida was surely one of the most significant, sensitive, and politically explosive actions the US Justice Department and FBI have ever taken. It’s one of a tiny handful of times the DOJ has ever investigated a president. And it’s an action that likely indicates the FBI and prosecutors had specific knowledge of both a definable crime and the evidence to back it up.

The actual search warrant, which would list specific crimes being investigated, has not been released yet. According to Monday night news reports, however, the search focused on questions about a number of boxes of classified documents that Trump took from the White House to his Florida mansion after leaving the presidency.

While it may take months to learn more about the underlying investigation, the fact that the FBI launched such a high-profile search already tells us a great deal about the state of the Justice Department’s case.

Here are the five big takeaways.

Probable Cause Was Clear

Federal search warrants aren’t designed to be fishing expeditions. The FBI’s legally authorized search of a former president’s primary residence would have been approved and monitored at the highest level of both the FBI and the Justice Department, likely including both the deputy attorney general and the attorney general. It’s hard to imagine how high the bar of probable cause must have been for the Bureau to initiate such a politically sensitive search. Ironically, the scandals the FBI has weathered from past Trump investigations likely made the bar for probable cause and sign-off by the department’s upper levels even higher.

One of the biggest scandals the FBI and Justice Department have endured in recent years was the sloppy (and ultimately illegal) paperwork surrounding a FISA warrant filed amid the 2016 presidential campaign that targeted Trump aide Carter Page. Two of the four warrants used in that case were later declared invalid, and an FBI lawyer pleaded guilty to falsifying part of the underlying evidence and probable cause paperwork. A nearly 500-page inspector general report eviscerated the Bureau’s handling of the FISA warrants, which were long thought to be one of the most thorough and careful of court filings and are supposed to be backstopped by careful evidence reviews known as the “Woods procedures.” As it turned out, the FBI had omitted key questions about the underlying evidence from the Page warrant application and offered misleading characterizations about other pieces of evidence.

That scandal led to internal FBI and Justice Department reforms that would have made the Mar-a-Lago search warrant subject to even closer scrutiny—and ensured that the bar for probable cause would have been so high, the evidence so crystal clear, that it’s likely the Justice Department already feels it has enough information to bring criminal charges.

A Judge Signed Off on the Search

A legally authorized search warrant is an important part of the US Constitution’s system of checks and balances. It requires the assent of two of the three branches of government, whereby the executive branch (the DOJ and the FBI) gets the sign-off from the judicial branch. In the case of the Trump property search, once agents and prosecutors assembled their evidence, an independent federal magistrate judge needed to agree that a crime was likely committed and that there was specific evidence at Mar-a-Lago that would have bearing on the crime.

Notably, this is at least the second time this year that a federal judge has agreed Trump was at least adjacent to a crime. As the January 6 congressional committee has repeatedly pointed out, a federal judge agreed with its assessment this spring that Trump “more likely than not” committed a crime amid his efforts to overturn the 2020 elections.

This Isn’t Just About Trump Taking Classified Docs

One of the most important questions in an investigation is about establishing motive, summed up by the Latin phrase _cui bono_, or _Who benefits?_ Sure, Trump taking home classified documents is technically a crime. But as national security reporter Zach Dorfman points out, it’s hardly a serious enough offense to spur the FBI to raid the home of a former president.

The entire security classification system exists to serve the presidency. The president is the one official in the US government with the ability to unilaterally declassify any piece of information. (Trump famously exercised this power while in office by tweeting a highly classified satellite photo of an Iranian facility). Plus, while classified documents theoretically include highly sensitive information that would damage national security if released, the reality is that many classified documents aren’t that sensitive.

Big Takeaways From the FBI's Mar-a-Lago Raid

Regulators are close to stopping Meta from sending EU data to the US, bringing a years-long privacy battle to a head.

Facebook faces trouble in Europe—and Meta wants you to know about it. Every three months since June 2018, the company has used its financial results to warn that it could be forced to stop running Facebook and Instagram across the continent—potentially pulling its apps from millions of people and thousands of businesses—if it can’t send data between the EU and the US.

Whether Meta’s bluffing will become clear soon enough.

Data regulators are on the verge of making a historic ruling in a years-long case, and they are expected to say Facebook’s data transfers across the Atlantic should be blocked. For years, Meta has fought against European privacy activists over how data is sent to the US, with courts ruling multiple times that European data isn’t properly protected and can potentially be snooped on by the NSA and other US intelligence agencies.

While the case focuses on Meta, it has widespread ramifications, potentially impacting thousands of businesses across Europe that rely upon the services of Google, Amazon, Microsoft, and more. At the same time, US and European negotiators are scrambling to finalize a long-awaited new data-sharing deal that will limit what information US intelligence agencies can get their hands on. If negotiators can’t get it right, people’s privacy will remain at risk and billions of dollars of trade will be put in jeopardy.

At the start of July, the Irish Data Protection Commission, Facebook’s main data regulator in Europe, issued a draft decision that would block Meta from sending data across the Atlantic. While the specifics of that draft decision aren’t known, if it is enacted, it could create a Facebook blackout across Europe.

Under the GDPR, Europe’s data law, countries across the continent get 30 days to scrutinize Ireland’s Meta decision and respond with any potential changes or complaints. That time is now up. A spokesperson for the Irish regulator says “some” objections have been received from a “small” number of other countries and it is working to address these. Experts say these are likely to be minor points of law, rather than overturning the entire decision.

So, how likely is it that Meta will actually pull its services from Europe? In reality, the chances are probably pretty slim. Meta has said it has “no desire” to leave the continent, going as far as publishing a blog post titled “Meta Is Absolutely Not Threatening to Leave Europe.” Europe’s 30-plus countries are a large market for Meta, and stopping services, even temporarily, could be costly. (A close comparison is when the company briefly banned news posts in Australia in early 2021, following a row with publishers.) While Meta may not leave Europe, it may have to make changes to how it stores and transfers data once the final decision from the Irish regulator is published, although there is no set timeline. It may also face a fine.

“My guess is that Meta is going to have to look at some form of geo-siloing if they want to continue to operate in the EU,” says Calli Schroeder, global privacy counsel at the Electronic Privacy Information Center, a nonprofit digital rights research organization. Schroeder, who previously worked with companies on international data transfers, says this approach could mean Meta would have to create its own servers and data centers in the EU that aren’t connected to its broader databases.

Harshvardhan Pandit, a computer science research fellow at Trinity College Dublin who is researching the GDPR, says that as data authorities are still considering Meta’s case and a final decision hasn’t been published yet, they could include several caveats or steps that Meta should take to fall in line. For instance, one recent data protection decision in Europe gave a six-month period for a company to make changes to its business.

“I think the most pragmatic solution would be for them to create the European infrastructure, like Google or Amazon, which have quite a few data centers here,” Pandit says, adding that Meta could also introduce more encryption to how it stores data and maximize how much it keeps in the EU. All these measures would be costly, though. Jack Gilbert, director and associate general counsel at Meta, says that the issue “is in the process of being resolved.” Facebook did not respond specifically to questions about its plan to respond to the Irish decision.

European officials have twice ruled that systems put in place to share data between the EU and US don’t properly protect people’s data—the complaints have been ongoing since the early 2010s. European courts ruled that international data-sharing agreements weren’t up to scratch first in 2015 and then again in July 2020, when the Privacy Shield agreement was ruled illegal.

“All that the EU is asking for when organizations transfer data to other countries is to protect that data in line with the GDPR,” says Nader Henein, a research vice president specializing in privacy and data protection at Gartner. “The issue is that laws in the US that protect the data of ‘nonresident aliens’ are woefully insufficient and make it very difficult for organizations like Facebook to comply with local law and the GDPR.”

While Meta is the focus of the most high-profile complaint, it isn’t the only company impacted by a lack of clarity on how companies in Europe can send data to the US. “The data transfer issue is not Meta-specific,” David Wehner, Meta’s chief strategy officer, said in a July earnings call. “It relates to how in general data is transferred for all US and EU companies back and forth to the US.”

The impacts of the July 2020 decision to get rid of Privacy Shield are now being felt. Since January of this year, multiple European data regulators have ruled that using Google Analytics, the company’s traffic-monitoring service for websites, falls foul of the GDPR. Danish authorities went even further: Schools can’t use Chromebooks without restrictions being put in place. “There is a ton of legal uncertainty, and there is a significant compliance risk,” says Gabriela Zanfir-Fortuna, vice president of global privacy at Future of Privacy Forum, a nonprofit think tank.

Politicians are well aware of the problems. In March, US president Joe Biden and European Commission president Ursula von der Leyen announced a new Trans-Atlantic Data Privacy Framework, which will change the way data is sent between the EU and US. The deal, which will be introduced by executive order, will limit what data US intelligence agencies can access and will create a new system where Europeans can complain if they think they’ve been illegally spied upon by US agencies.

However, since the deal was announced, no specifics—including any legal texts—have been published. In June, officials said the deal could be published in the coming weeks, but so far, there has been little public progress. The US Department of Commerce says discussions are still taking place, including a meeting between both sides last week. (A European Commission spokesperson says work on the new agreement is ongoing, but they do not have a timeline that can be shared.) The longer the negotiations take, the more blocking orders will drop. “Obviously, if that framework is not complete, we would be in jeopardy of being able to transfer data,” Facebook’s Wehner said earlier this year.

The deal is likely to take a while yet. “Realistically, at this point, we're looking at a potential adequacy decision for this Trans-Atlantic data transfers framework sometime next year—maybe the first quarter of next year,” Zanfir-Fortuna says. Once the details have been published, EU officials will spend months scrutinizing the specifics to see if they fall in line with court orders.

And they won’t be the only ones pouring over it. Privacy activists and lawyers will also be looking at the agreement and could launch further legal challenges if they find that data moving from Europe to the US still isn’t protected strongly enough. “The continued challenges are not unwarranted, particularly considering the Snowden revelations and the prevalence of Big Tech firms coming out of the US,” Schroeder says. “As a whole, America really needs to make sure we rise to the challenge of showing that we can be good stewards of the industry that we're trying to be leaders in.”

Will Europe Force a Facebook Blackout?

The popular Microsoft-owned code repository plans to roll out code signing, which will help beef up the security of open source projects.

Following the 2020 SolarWinds cyberespionage campaign in which Russian hackers slipped tainted updates into a widely used IT management platform, a series of other software supply chain attacks has continued to show the urgent need to lock down software chains of custody. And the issue is particularly pressing in open source where projects are inherently decentralized and often ad hoc endeavors. After a series of worrying compromises to widely downloaded JavaScript software packages from the prominent “npm” registry, which is owned by GitHub, the company laid out a plan this week to offer expanded defenses for open source security.

GitHub, which itself is owned by Microsoft, announced on Monday that it plans to support code signing, a sort of digital wax seal, for npm software packages using the code signing platform Sigstore. The tool grew out of cross-industry collaboration to make it much easier for open source maintainers to verify that the code they create is the same code that ends up in the software packages actually being downloaded by people worldwide.

“While most npm packages are open source, there’s currently no guarantee that a package on npm is built from the same source code that’s published,” says Justin Hutchings, GitHub's director of product management. “Supply chain attacks are on the rise, and adding signed build information to open source packages that validates where the software came from and how it was built is a great way to reduce the attack surface.”

In other words, it's all about creating a cryptographically verified and transparent game of telephone. 

Dan Lorenc, CEO of Chainguard, which co-develops Sigstore, emphasizes that while GitHub isn't the only component of the open source ecosystem, it's an absolutely crucial town square for the community because it's where the vast majority of projects store and publish their source code. When developers actually want to download open source applications or tools, though, they typically go to a package manager 

“You don’t install source code directly, you usually install some compiled form of it, so something has happened in between the source code and the creation of the package. And up until now, that whole step has just been a black box in open source,” Lorenc explains. “You see the code and then go and download the package, but there’s nothing that proves that the package came from that code or the same person was involved, so that’s what GitHub is fixing."

By offering Sigstore to package managers, there's much more transparency at every stage of the software's journey, and the Sigstore tools help developers manage cryptographic checks and requirements as software moves through the supply chain. Lorenc says that many people are shocked to hear that these integrity checks aren't already in place and that so much of the open source ecosystem has been relying on blind trust for so long. In May 2021, the Biden White House issued an executive order that specifically addressed software supply chain security. 

“People say, ‘didn’t we already have this?’ That gap where there’s the code and then there's the package—most people just don’t believe you or are terrified," Lorenc says.

Sigstore is co-developed by The Linux Foundation, Google, Red Hat, Purdue University, and Chainguard. The open source software development platform Kubernetes now supports Sigstore, and there is an official tool for signing Python package distributions using Sigstore.

“Traditional methods of managing signing keys just don’t scale well to the sheer size of the open source community and don't give insight into how the software was built," GitHub's Hutchings says. “One of the things we like about Sigstore is that it’s zero-configuration for end users, so we can scale this up with our developer ecosystem regardless of where the source code lives."

Similar to the massive industry effort to promote HTTPS web encryption, made possible in large part by tools like Let's Encrypt from the nonprofit Internet Security Research Group, Sigstore relies on being free and easy to use to spur adoption. Github says it is starting with a proposal on how Sigstore will be implemented for npm and an open comment period to get feedback from the community on exactly how the tool will be deployed. But ultimately the goal is to bring such code signing to as much of the open source world as possible to make supply chain attacks much more difficult.  

“We want to see a world where eventually all software artifacts are signed and linked back to the source code,” GitHub's Hutchings says. “That is why it is so important to build on an open technology stack like Sigstore that other packaging repositories can adopt as well."

Github Moves to Guard Open Source Against Supply Chain Attacks

The new Pretty Good Phone Privacy service for Android hides the data linking you to your mobile device.

As marketers, data brokers, and tech giants endlessly expand their access to individuals’ data and movements across the web, tools like VPNs or cookie blockers can feel increasingly feeble and futile. Short of going totally off the grid forever, there are few options for the average person to meaningfully resist tracking online. Even after coming up with a technical solution last year for how phone carriers could stop automatically collecting users’ locations, researchers Barath Raghavan and Paul Schmitt knew it would be challenging to convince telecoms to implement the change. So they decided to be the carrier they wanted to see in the world.

The result is a new company, dubbed Invisv, that offers mobile data designed to separate users from specific identifiers so the company can’t access or track customers’ metadata, location information, or mobile browsing. Launching in beta today for Android, the company’s Pretty Good Phone Privacy or PGPP service will replace the mechanism carriers normally use to turn cell phone tower connection data into a trove of information about users’ movements. And it will also offer a Relay service that disassociates a user’s IP address from their web browsing.

“If you can decouple a user’s identity from the way they connect to a network, that’s a general-purpose hammer that can solve a lot of privacy problems,” says Raghavan, a professor at the University of Southern California. “Privacy should be the default and it’s not currently, so we’re working on that. There’s a growing appetite as people become more concerned about what their phone is leaking to telecoms and tech companies.”

PGPP’s ability to mask your phone’s identity from cell towers comes from a revelation about why cell towers collect the unique identifiers known as IMSI numbers, which can be tracked by both telecoms and other entities that deploy devices known as IMSI catchers, often called stringrays, which mimic a cell tower for surveillance purposes. Raghavan and Schmitt realized that at its core, the only reason carriers need to track IMSI numbers before allowing devices to connect to cell towers for service is so they can run billing checks and confirm that a given SIM card and device are paid up with their carrier. By acting as a carrier themselves, Invisv can implement their PGPP technology that simply generates a “yes” or “no” about whether a device should get service. 

On the PGPP “Mobile Pro” plan, which costs $90 per month, users get unlimited mobile data in the US and, at launch, unlimited international data in most European Union countries. Users also get 30 random IMSI number changes per month, and the changes can happen automatically (essentially one per day) or on demand whenever the customer wants them. The system is designed to be blinded so neither INVISV nor the cell towers you connect to know which IMSI is yours at any given time. There’s also a “Mobile Core” plan for $40 per month that offers eight IMSI number changes per month and 9 GB of high-speed data per month.

Both of these plans also include PGPP’s Relay service. Similar to Apple’s iCloud Private Relay, PGPP’s Relay is a method for blocking everyone, from your internet provider or carrier to the websites you visit, from knowing both who you are and what you’re looking at online at the same time. Such relays send your browsing data through two way stations that allow you to browse the web like normal while shielding your information from the world. When you navigate to a website, your IP address is visible to the first relay—in this case, Invisv—but the information about the page you’re trying to load is encrypted. Then the second relay generates and connects an alternate IP address to your request, at which point it is able to decrypt and view the website you’re trying to load. The content delivery network Fastly is working with Invisv to provide this second relay. Fastly is also one of the third-party providers for iCloud Private Relay.

In this way, each relay knows some of the information about your browsing; the first simply knows that you are using the web, and the second sees the sites you connect to, but not who specifically is browsing there. In addition to being included in the two PGPP data plans, customers can also purchase the Relay service on its own for $5 per month and turn it on while connected to mobile data or Wi-Fi. 

“User privacy has historically been in the backseat for internet systems,” says Jana Iyengar, Fastly’s product lead for infrastructure services. “At Fastly, we have always believed that communication and data privacy is fundamental to the future of the internet. We believe it is time to invest, engage, and create products that will move the internet forward in this direction.”

Invisv is still working to bring its services to Apple’s iOS, and the company doesn’t provide voice calling services, only mobile data. But Raghavan and Schmitt say that their goal for this initial launch was to start offering something that would give customers drastically more privacy protection than what they get from other mobile carriers while being truly easy to use.

“The reason we’re doing this, honestly, is that it’s clear nobody else is going to do it,” Schmitt says. “I’m hopeful that people will just start to see what's possible from this, so we can start to make a dent.”

A Phone Carrier That Doesn’t Track Your Browsing or Location

Whether you want to turn off link previews or block unwanted FaceTime calls, here's what you need to know.

Apple prides itself on the security measures built into its software and hardware—and it continues to add new protections and safeguards over time. Lockdown Mode is a new feature heading to iPhones, iPads, and Macs later this year, and it promises to protect your devices from "highly targeted cyberattacks."

As you might surmise from the name, Lockdown Mode is a bit like closing the shutters, double-bolting the doors, and turning off all the lights in your home. It severely restricts the kinds of activity allowed on your devices, the logic being that if something unwanted has gained access, the damage will be limited.

For example, attachments other than images get turned off in Messages, and link previews are disabled. Incoming FaceTime calls from unknown numbers are blocked, as are wired connections with other hardware and accessories. Shared albums are removed from the Photos app, and new shared album invitations are blocked.

On a more technical level, a number of web technologies are turned off, including just-in-time (JIT) JavaScript compilation (where code is run and compiled at the same time.) In addition, configuration profiles (for work or school for example) can't be installed.

Lockdown Mode will be arriving on iPhones with iOS 16.

Courtesy of Apple

Lockdown Mode is disabled by default but can be enabled on an iPhone by going to **Settings**, then **Privacy and Security**, then **Lockdown Mode**. Turning it on or off requires a system reboot and the device's PIN. While Apple is describing the feature as something for users at risk from "state-sponsored mercenary spyware"—which sounds like high-profile targets—anyone will be able to switch it on for additional protection.

"Lockdown Mode is an extreme, optional protection that should only be used if you believe you may be personally targeted by a highly sophisticated cyberattack," is the way that Apple puts it in its support documentation. "Most people are never targeted by attacks of this nature."

As Apple explains, the overall idea is to reduce the attack surface that malware and spyware have access to. Tools including the Pegasus spyware package developed by the NSO Group have the potential to read texts, track calls, collect passwords, monitor a user's location, and more—and some require no interaction from the user.

With Pegasus, for example, a WhatsApp call to the target device is all it takes for the spyware to start its work, even if the call isn't answered. It's worth noting that this particular piece of spyware is blocked from running on devices with iOS 15 or higher installed, but there are plenty of other threats still out there, and plenty more that will be developed in the future.

With Lockdown Mode enabled, it should be much harder for spyware to take root in the first place. If a device has already been compromised, the mode will limit the impact that the malicious code can have. You might want to turn it on while traveling, for example, or if you've noticed any suspicious activity on your smartphone.

Turning Lockdown Mode on or off requires a full device reset.

Courtesy of Apple

Apple says it's going to continue to strengthen Lockdown Mode with additional features over time, and it has also announced a related bug bounty program: Anyone who manages to discover a security vulnerability in the Lockdown Mode protections is eligible for a payout from Apple of up to $2 million. Further funds are being made available for organizations that are fighting back against spyware and cyberattacks.

Those funds will be distributed by representatives from a number of interested parties, including The Engine Room, Amnesty Tech, Access Now, and the Citizen Lab, a security research group operating out of the University of Toronto in Canada.

"There is now undeniable evidence from the research of the Citizen Lab and other organizations that the mercenary surveillance industry is facilitating the spread of authoritarian practices and massive human rights abuses worldwide," says Ron Deibert, the director of the Citizen Lab.

We're expecting iOS 16 to launch alongside the new iPhones in September (and iPadOS 16 and macOS Ventura should appear around the same time.) Other security features coming with the update include a Safety Check feature for resetting access to other individuals (useful in domestic and partner violence situations), and Apple will also begin to push out security patches in between major software updates.

How to Use Lockdown Mode in iOS 16 to Make Your Phone More Secure

Plus: A crypto-heist extravaganza, a peek at an NSO spyware dashboard, and more.

Cryptocurrency tracing has become a key tool for police investigating everything from fraud and ransomware to child abuse. But its accuracy may soon be put to the test.

This week, we reported on new court filings from the legal team representing Roman Sterlingov, who’s been in jail for 15 months, accused of laundering $336 million in cryptocurrency as the alleged owner and operator of dark-web crypto mixer Bitcoin Fog. Sterlingov not only maintains he is innocent, but his defense attorney claims that the blockchain analysis that served as evidence that Sterlingov set up Bitcoin Fog is flawed.

Elsewhere, we highlighted Microsoft’s newly bolstered Morse bug-hunting team, which aims to catch flaws in the company’s software before they cause problems for the company’s 1 billion users. We dove into the spectacular failure of a new post-quantum encryption algorithm. We listed all the big security updates you need to be on top of from July, and we detailed all the data that Amazon’s Ring cameras collect about you.

Finally, a new report from cybersecurity company Mandiant found an attack on Albania’s government has the hallmarks of state-sponsored Iranian hacking—a notable moment of escalation in the history of cyberwar, given that Albania is a NATO member. And we got into the weeds of a Slack error that exposed hashed passwords for five years.

But that’s not all. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

This is not a test. Software used to transmit US government-issued emergency alerts on television and radio contains flaws that could allow an attacker to broadcast false messages, according to the Federal Emergency Management Agency and the security researcher who found the vulnerabilities. The company that makes the software, Digital Alert Systems, has issued patches, and FEMA has alerted the TV and radio networks that use the software to update their devices immediately. Of course, patches may not be universally adopted, leaving the system at risk. There’s no evidence that an attacker has exploited the flaws so far. But considering the mayhem false emergency alerts can cause, we’ll just have to hope that it stays that way.

One major theft of cryptocurrency in a week would be bad, and this week saw two. First, thanks to a flaw in the Nomad bridge—a type of application that lets users move digital tokens across blockchains that are prime hacker targets—“hundreds” of people were able to steal a collective $190 million in cryptocurrencies. Nomad now says that anyone who returns 90 percent of the funds they swiped will be considered a “white hat” and can keep the remaining 10 percent as a bounty. Some $22 million of the stolen funds had been recovered so far.

The second crypto hack of the week came just a day later, on Tuesday night, with hackers draining around 8,000 “hot” wallets (cryptocurrency storage apps that are connected to the internet) connected to the Solana ecosystem, allowing them to steal around $5 million worth of crypto. Solana said in a tweet that the exploit was due to a bug in “software used by several software wallets popular among users of the network,” not the Solana network or its cryptography.

It’s one thing to be told what NSO Group’s spyware can do, but it’s quite another to see it for yourself. Reporters at Israel’s _Haaretz_ got their hands on never-before-seen screenshots of Syaphan, a prototype of NSO’s now-infamous Pegasus spyware, which has retained much of the look and functionality of its precursor. The screenshots show that operators have the ability to access call logs and messages and remotely enable cameras and microphones to turn an infected device into a real-time spying tool.

Government use of Pegasus and other spyware has resulted in a growing number of scandals, particularly in Europe. Yesterday, Panagiotis Kontoleon, the head of Greece’s intelligence service, and Grigoris Dimitriadis, general secretary of the prime minister’s office, resigned. Their departures follow a complaint filed by Nikos Androulakis, the head of the socialist PASOK party, who alleged that his phone had been targeted by Predator spyware created by Cytrox, which is based in neighboring North Macedonia. Greece’s prime minister’s office maintains, however, that the resignations and the spyware allegations are unconnected. “In no case does it have anything to do with Predator (spyware), to which neither he nor the government are in any way connected, as has been categorically stated,” it said in a statement.

Remember a few months ago when everyone was mad at DuckDuckGo? Well, that thing you were angry about has now been (mostly) fixed, according to the company. Back in May, security researcher Zach Edwards found that DuckDuckGo’s privacy browsers—not its search engine, for which the company is better known—allowed some third-party Microsoft tracking scripts. DuckDuckGo, which has a partnership with Microsoft, says it has expanded its 3rd-Party Tracker Loading Protection to include 21 more domains, thus blocking the bulk of Microsoft tracking scripts on websites accessed via its mobile DuckDuckGo Privacy Browser or while using its Privacy Essentials extension, which can be used with all major browsers. However, DuckDuckGo will still allow advertisers to track clicks from DuckDuckGo through scripts from the bat.bing.com domain. Is it perfect? No—even DuckDuckGo admits that. But it’s still a privacy improvement over mainstream browsers and search engines.

The US Emergency Alert System Has Dangerous Flaws

Now that Charter has reached settlements with major record labels, it’s unclear whether the cable provider will pull the plug on users who pirate music.

Charter Communications has agreed to settle piracy lawsuits filed by the major record labels, which accused the cable internet provider of failing to terminate the accounts of subscribers who illegally download copyrighted songs.

Sony, Universal, Warner, and their various subsidiaries sued Charter in US District Court in Colorado in March 2019 in a suit that claimed the ISP helps subscribers pirate music by selling packages with higher internet speeds. They filed another lawsuit against Charter in the same court in August 2021.

Both cases were settled. The record labels and Charter told the court of their settlements on August 2 in filings that said, “The Parties hereby notify the Court that they have resolved the above-captioned action.” Upon the settlements, the court vacated the pending trials and asked the parties to submit dismissal papers within 28 days.

Charter subsidiary Bright House Networks also settled a similar lawsuit in US District Court for the Middle District of Florida this week. The record labels’ case in Florida was settled one day before a scheduled trial, as TorrentFreak reported on August 2. The case was dismissed with prejudice after the settlement.

No details on any of the settlements were given in the documents notifying the courts. A three-week jury trial in one of the Colorado cases was scheduled to begin in June 2023 but is no longer needed.

The question for internet users is whether the settlements mean that Charter will be more aggressive in terminating subscribers who illegally download copyrighted material. Charter declined to comment when Ars Technica asked whether it agreed to increase account terminations of subscribers accused of piracy. Ars Technica also contacted the big three record labels and will update this article if they provide any information on the settlements.

$1B Cox Verdict May Force ISPs to Cut Off Subscribers

Even if the settlements have no specific provision on terminating subscribers, Charter presumably has to pay the record labels to settle the claims. That could make the country’s second-biggest ISP more likely to terminate subscribers accused of piracy in order to prevent future lawsuits.

A jury ruled in December 2019 that Cox must pay $1 billion in damages to the major record labels in a case filed in US District Court for the Eastern District of Virginia. That decision raised alarm bells for the Electronic Frontier Foundation (EFF), the Center For Democracy and Technology, the American Library Association, the Association of College and Research Libraries, the Association of Research Libraries, and consumer-advocacy group Public Knowledge.

Those groups warned in a June 2021 court filing that the verdict, if not overturned, “will force ISPs to terminate more subscribers with less justification or risk staggering liability.” The US Court of Appeals for the Fourth Circuit heard oral arguments in March 2022 and has not yet issued a ruling.

Charter Motion to Dismiss Denied

In the Colorado court, the record labels’ complaint said Charter “has knowingly contributed to, and reaped substantial profits from, massive copyright infringement committed by thousands of its subscribers. Charter has insisted on doing nothing—despite receiving thousands of notices that detailed the illegal activity of its subscribers, despite its clear legal obligation to address the widespread, illegal downloading of copyrighted works on its internet services, and despite being sued previously by Plaintiffs for similar conduct.”

Charter argued in a motion to dismiss the case that “a failure to terminate a customer’s access to the internet based solely upon unverified (and unverifiable) notices alleging past infringement does not demonstrate the requisite intent by an ISP to encourage infringement.” Charter said it has a “policy to not terminate customer accounts based solely upon the receipt of notices containing unverifiable accusations of infringement.”

Charter also wrote that “plaintiffs do not (and cannot) allege that termination restricts access to the infringing content. It is common sense that terminating a customer’s internet connection does not prevent a customer from finding another source of Internet access, nor does it impact the availability of the allegedly infringing content hosted via peer-to-peer networks or programs. Charter has no more ability to block access to peer-to-peer networks than a subscriber's electric company.” Charter’s motion to dismiss the case was denied, and the company ultimately chose not to go to trial.

In Florida, the judge dismissed the record labels’ claim for vicarious liability, but the industry’s complaint also sought damages for vicarious copyright infringement.

_Disclosure: The Advance/Newhouse Partnership, which owns 12.4 percent of Charter, is part of Advance Publications. Advance Publications owns Condé Nast, which owns Ars Technica and WIRED._

_This story originally appeared on_ _Ars Technica__._

Source

Wired