Plus: Chrome patches another zero-day flaw, Microsoft closes up 100 vulnerabilities, Android gets a significant patch, and more.

August was a bumper month for security patches, with Apple, Google, and Microsoft among the firms issuing emergency fixes for already exploited vulnerabilities. The month also saw some big fixes arriving from the likes of VMWare, Cisco, IBM, and Zimbra.

Here’s everything you need to know about the important security fixes issued in August.

Apple iOS 15.6.1

After a two-month patch hiatus, followed by multiple fixes in July, Apple released an emergency security update in August with iOS 15.6.1. The iOS update fixed two flaws, both of which were being used by attackers in the wild.

It is thought that the vulnerabilities in WebKit (CVE-2022-32893) and the Kernel (CVE-2022-32894) were being chained together in attacks, with serious consequences. A successful attack could allow an adversary to take control of your iPhone and access your sensitive files and banking details.

Combining the two flaws “typically provides all the functionality needed to mount a device jailbreak,” bypassing almost all Apple-imposed security restrictions, Paul Ducklin, a principal research scientist at Sophos, wrote in a blog analyzing the vulnerabilities. This would potentially allow adversaries to “install background spyware and keep you under comprehensive surveillance,” Ducklin explained.

Apple always avoids giving out details about vulnerabilities until most people have updated, so it’s hard to know who the attack targets were. To ensure you are safe, you should update your devices to iOS 15.6.1 without delay.

Apple also released iPadOS 15.6.1, watchOS 8.7.1, and macOS Monterey 12.5.1, all of which you should update at the next opportunity.

Google Chrome

Google released a security update in August to fix its fifth zero-day flaw this year. In an advisory, Google listed 11 vulnerabilities fixed in August. The patches include a use-after-free flaw in FedCM—tracked as CVE-2022-2852 and rated as critical—as well as six highly rated issues and three classed as having a medium impact. One of the highly rated vulnerabilities has been exploited by attackers, CVE-2022-2856.

Google hasn’t provided any detail about the exploited flaw, but since attackers have gotten ahold of the details, it’s a good idea to update Chrome now.

Earlier in August, Google released Chrome 104, fixing 27 vulnerabilities, seven of which were rated as having a high impact.

Google Android

The August Android security patch was a hefty one, with dozens of fixes for serious vulnerabilities, including a flaw in the framework that could lead to local privilege escalation with no additional privileges needed. Meanwhile, an issue in the media framework could lead to remote information disclosure, and a flaw in the system could lead to remote code execution over Bluetooth. A vulnerability in kernel components could also lead to local escalation of privileges.

The Android security patch was late in August, but it’s now available on such devices as Google’s Pixel range, the Nokia T20, and Samsung Galaxy devices (including the Galaxy S series, Galaxy Note series, Galaxy Fold series, and Galaxy Flip series).

Microsoft

Microsoft’s August Patch Tuesday fixed over 100 security flaws, of which 17 are rated as critical. Among the fixes was a patch for an already exploited flaw tracked as CVE-2022-34713, also known as DogWalk.

The remote code execution (RCE) flaw in the Windows Support Diagnostic Tool (MDST) is rated as having a high impact because exploiting it can result in a system compromise. The vulnerability, which affects all users of Windows and Windows Server, was first exposed over two years ago in January 2020, but Microsoft didn’t consider it a security issue at the time.

VMWare

VMWare fixed a bunch of flaws in August, including a critical authentication bypass bug tracked as CVE-2022-31656. On releasing the patch, the software firm warned that public exploit code is available.

VMWare also fixed an RCE vulnerability in VMware Workspace ONE Access, Identity Manager, and Aria Automation (formerly vRealize Automation), tracked as CVE-2022-31658 with a CVSS score of eight. Meanwhile, a SQL injection RCE vulnerability found in VMware Workspace ONE Access and Identity Manager also got a CVSS score of eight. Both require an attacker to have administrator and network access before they can trigger remote code execution.

Apple Fixed a Serious iOS Security Flaw—Have You Updated Yet?

In the last two weeks of the war, an ad hoc team armed with group chats, QR codes, and satellite maps launched a mad dash to save imperiled Afghan allies.

Inside the Shadow Evacuation of Kabul

Anti-Putin media network February Morning has become a central player in the underground fight against the Kremlin.

On the evening of August 20, Russian TV pundit and conspiracy theorist Darya Dugina was killed on the outskirts of Moscow when a powerful explosion ripped apart her Toyota Land Cruiser. Dugina was a vocal supporter of Russia's invasion of Ukraine and the daughter of fascist philosopher and writer Alexander Dugin, nicknamed “Putin’s brain” thanks to his perceived ties to Russian president Vladimir Putin. According to Russian authorities, a remote-controlled “explosive device,” presumably installed in her car, went off at around 9 pm local time.

News of Dugina’s assassination spread like wildfire through social media, most notably on the instant messaging service Telegram, where it was shared approvingly by a vast network of Russian and Ukrainian channels. But in the hours that followed, it became clear that one channel, operated by the media outlet Utro Fevralya, or February Morning, is more than just a place to share the news. It aims to play a key role in the story.

Created by exiled former Russian MP and dissident Ilya Ponomarev, February Morning was the first to report on a group claiming responsibility for Dugina’s death. Ponomarev himself took to YouTube, where February Morning airs its shows, claiming that the perpetrators were a little-known Russian resistance group called the National Republican Army. According to Ponomarev, an all-out war against “Putinism” had just begun.

While the National Republican Army’s involvement remains unconfirmed, Ponomarev’s announcement crystallized February Morning’s role as the center of gravity of a growing guerilla movement to spark revolution in Russia. The movement’s ecosystem includes activists and saboteurs of all types, from anarchists to fascists, connected through a network of Telegram channels and a singular goal: overthrowing Vladimir Putin.

Making History

On a sun-drenched balcony overlooking a busy street in downtown Kyiv, 48-year-old Evgeni Lesnoy smokes a final cigarette before going back on the air. The seasoned journalist is one of the faces of February Morning, which he joined shortly after its creation following Russia’s invasion of Ukraine in the early hours of February 24. “Because of my friends and relatives who stayed in Russia, I had been closely following the events there prior to February 24,” Lesnoy says in Russian. After his outspoken condemnation of the war in Donbas and the annexation of Crimea cost him his friends and, ultimately, his job, the journalist left Russia for Ukraine in 2015 and has been living with his husband in Kyiv ever since.

“When I was told that this project existed, I figured that this is where I needed to be,” he says, gesturing towards the TV studio in the next room. “Because I understand the context of what is happening inside Russia: I was born there, and I understand how people there think.”

Ponomarev, February Morning’s founder, is the only member of the Russian Duma to have voted against the 2014 annexation of Crimea. After the vote, he became persona non grata in Putin’s Russia, so he and his family fled to Ukraine’s capital city and started a new life. “For quite a long time, I had wanted to create a media aimed at a Russian audience, and that would broadcast from Kyiv,” he tells WIRED over Signal. “I tried to raise money for what I thought would be a Russian-language Al-Jazeera for maybe a year._”_ The venture was unsuccessful. But when Russian tanks crossed into Ukraine, the former MP and father of two joined the Territorial Defense in Kyiv, and the project took on new urgency. “After the first couple of days, many of my friends started telling me that now might be the time to revisit the idea of a media targeting Russians.”

The living room of the 18th-century apartment in which February Morning has taken residence is home to its television studio with a semicircular stage lit with a bluish light. Two screens broadcast in the background. When presenting the day’s show, Lesnoy sits before a small table draped with a white and blue tricolor flag—the symbol of the Russian opposition to the invasion—and that of Ukraine.

Broadcast on YouTube, the professionally produced daily programs try to counter the official Russian narrative surrounding the war, reporting on the atrocities committed by the “occupiers” against the Ukrainian population. “Putin’s supporters and apologists have big media organizations and prime-time news shows,'' says Lesnoy. “We want to give a voice to those who oppose the war.”

Which is what Ponomarev did on August 21, when he claimed on air that the National Republican Army assassinated Dugina—an act he described as “legitimate.” He also read the group’s purported manifesto, which called on all Russians to join the ranks of the National Republican Army and vow to destroy all those who have “usurped their power.”

February Morning’s insights into the domestic resistance movement in Russia stem from its 27 regional outlets, each with its own Telegram channel where activists and journalists mingle to gather and share news of anti-Putin actions. A binational team of around 70 journalists, technicians, and activists operates covertly in the far-flung regions of Russia and in Kyiv. In addition to its studio in Ukraine’s capital, the network brazenly broadcasts from Moscow. “I don't know how long the studio there will be able to operate, but even if the FSB shows up at the door and shuts us down, there will be another one,” says Ponomarev.

Whereas most media outlets only report the story, February Morning intends to be part of it. “We are referring to ourselves as the Russian ‘NEXTA,’ the Belarusian resource that played a key role in the protests two years ago following the reelection of Alexander Lukashenko,” says Ponomarev, referring to Belarus’ autocratic leader. “We want to be the resource that will play a critical role in the future revolutionary changes in the country.”

To this end, Ponomarev and his team have set up a Telegram channel known as Rospartizan, which has become an aggregator for information pertaining to the resistance to Putin and the war in Ukraine as well as a key recruitment tool. Every day, Rospartizan relays the latest developments across Russia, from the torching of a military recruitment office to the unfurling of an antiwar banner in front of the Russian Ministry of Defense building in Moscow.

According to Ponomarev, representatives of the National Republican Army first made contact with him through Rospartizan, a testament to the channel’s growing notoriety. “We are providing, in my opinion, the most comprehensive news stream on what is going on in Russian regions, in terms of acts of sabotage and the actual resistance,” says Ponomarev. The National Republican Army’s manifesto concludes, “stay in contact with us through the Rospartizan Telegram channel.”

With more than 26,000 followers, Rospartizan embraces anyone who’s anti-Putin, no matter their political ideology—a feature, not a bug, according to Ponomarev, a former Communist Party member and self-described “social globalist.”

“I am right now not only reaching out, but very actively interacting with not only my friends on the left side of the political spectrum,” he says, “but also with people on the far-right, who we are usually fighting with.”

The Enemy of My Enemy

Roman Popkov, the former head of the Moscow branch of the National-Bolshevik party, falls into that far-right camp. Popkov used to be a member of the influential Russian National Unity, a now-defunct neo-Nazi group responsible for a string of racist crimes, before joining the political party founded by controversial Russian writer, poet, and dissident Eduard Limonov, who sought to unite far-left and far-right radicals on the same platform.

In 2006, after years of harassment by Russian security forces, Popkov was arrested and spent more than two years in pretrial detention in the infamous Butyrka prison. The European Court of Human Rights ruled that his detention was illegal, and his arrest is widely considered to have been motivated by his political activism.

Popkov, now residing in Ukraine, works as a journalist for a number of independent media outlets, and is the head of a recently launched media project called Poslezavtra, or “The Day After Tomorrow.” An “old friend” of Ponomarev, Popkov has featured extensively on February Morning’s shows and took part in the broadcast that followed Dugina’s assassination.

“We are covering direct actions targeting the military and the apparatus of political repression of Putin's regime,'' Popkov says over the phone. “First of all, we are trying to inspire people, to get them to act, and second, we inform and report on what is being done.”

Like Ponomarev, Popkov stresses that activists’ ideologies are not as important as a willingness to defy Putin’s regime and to oppose the war in Ukraine.

“Our collective unites people opposed to Putin's regime, with different political views and ideologies,” says Popkov. “At the moment, it's not that important if one is an anarchist, a nationalist, or a liberal as, since Russia is not a democracy, we have no representation in parliament, and can't vote for our candidates.”

According to Popkov, acts of sabotage in Russia are mostly the work of small-scale far-right and far-left groups, the most famous of those being the Anarcho-Communist Combat Organization, or BO-AK. The organization rose to prominence after it sabotaged the railway leading to a Russian military arsenal in the small town of Kirzach, 100 km east of Moscow. The group shared photos of the sabotage on their own Telegram channel, which quickly spread to other anti-Putin channels, including Rospartizan, and was soon featured on February Morning’s broadcast.

Yet even the staunch anarchists of the BO-AK acknowledge the need to reach out to the other side of the political spectrum. “Most of our contacts are from our ideological camp, but not all,” an anonymous representative of the group tells WIRED. “We believe that alliances with different forces are necessary in our struggle.”

The anarchists of the BO-AK consider direct actions and acts of sabotage as the best way to kickstart the social revolution, a view shared by many members of Rospartizan. In addition to two sabotage operations targeting military railways, the BO-AK claims to have set fire to a cell phone tower in the Belgorod region “in order to damage Putin’s army communications in Ukraine.”

“Only those who can back it with their actions can call themselves the opposition,” an anonymous contributor to Rospartizan says over Telegram, “be them a Molotov cocktail thrown at a military recruitment office, a wire strung across train tracks, or a gas canister taken to the car of a regime collaborator.”

Dangerous Cocktails

Inspired by the Belarusian resistance to Lukashenko and the protestors’ innovative use of Telegram, Popkov, Ponomarev, and activists like the anarchists of BO-AK have turned to social media to organize, recruit, and incite people to act against the war and Putin’s increasingly authoritarian regime.

“Telegram is a less censored, more intelligent, and politicized social network. A large part of our immediate target audience is present here—people who are potentially interested in radical politics,_”_ says the BO-AK. “This is where lies the usefulness of social networks for campaigning and education—they are an excellent channel for broadcasting and communicating.”

Antiwar activists in Ukraine and in Russia have taken full advantage of the relative anonymity Telegram provides. A website known as Ostanovi Vagony, or “Stop the Wagon,” and its associated Telegram channel aim to educate Russian would-be partisans on the safest, most effective ways to sabotage the railway system. Meanwhile, a Telegram channel created in late May called Gromko (“loud” in Russian) creates sleek infographics explaining how to make a Molotov cocktail—described as the best way to disable the car of a Putin sympathizer—or how to deface the regime’s propaganda posters.

This material is regularly shared by Ponomarev's Rospartizan, which has become a central conduit for guerrilla efforts to rally new recruits, spread information and news, and, purportedly, to facilitate the assassination of a high-profile regime collaborator. In an interview with Russian independent media Meduza, Ponomarev claimed to have known in advance that “something was going to happen” ahead of Dugina’s assassination. He further claimed that he helped the National Republican Army exfiltrate Natalya Volk, the woman whom Russian security services named as the main suspect in her death: “Sometimes people need to be saved from FSB persecution, they need to be pulled out of Russia—we pull them out.”

Telegram did not respond to WIRED's request for comment.

While unconfirmed, the number of acts of sabotage targeting military and state infrastructure in Russia appears to grow weekly. According to Russian independent media Insider, there have been more than 20 attacks on military registration and enlistment offices in Russia (which were reported by the media and Telegram channels), most of which were arson. “There were no similar incidents last year,” notes Insider journalist Alisa Zemlyanskaya, writing under a pseudonym. Meanwhile, an estimated 63 freight trains derailed in Russia between March and June, a significant increase compared to the same period last year.

Russian authorities, eager to downplay the significance of the apparent sabotage efforts, have blamed those incidents on the poor condition of the railway system. The scale of guerrilla attacks on Russian entities remains, therefore, difficult to assess.

“When it comes to railway sabotage especially, it's difficult, or even impossible, to tell if it’s sabotage, or if it’s an accident due to a technical problem, or to the incompetence of the authorities,” says Popkov.

According to the BO-AK—whose members signed the sabotaged section of rail in Kirzach with the name of their group and the link to its Telegram channel—“that’s because many guerrilla groups do not leave any message or position themselves in the media in any way.”

“In any case, every week there are several reports of railway sabotage, the destruction of power lines, and other acts of resistance,” says the group. “This suggests that the guerrilla movement is not a mass movement, but a fairly large-scale one.”

Russian security services are quick to blame infiltrated Ukrainian saboteurs for these attacks. Regardless of who’s behind them, acts of sabotage continue unabated: On August 17, yet another freight train derailed near Mogilev, in Belarus, while last Wednesday, a man threw two Molotov cocktails at the regional administration building in Oryol, in western Russia.

Fire-bombing a car or derailing a Russian train can, of course, carry significant penalties. But even less extreme activities are dangerous, especially in light of a slew of new repressive Russian laws. In July, lawmakers updated Russia’s Criminal Code to crack down on working with “foreign states and organizations,” public activities “directed against the security of the state,” and the production and public display of “Nazi paraphernalia or symbols.” Because Putin has repeatedly claimed, baselessly, that Ukraine was run by a clique of drug addicts and Nazis and cited “denazification” as one of the primary motivators of his invasion, this last amendment could potentially land an antiwar protestor waving a Ukrainian flag in prison.

According to Russian independent media OVD-Info, authorities in Russia detained some 16,500 people between February and July for having taken part in protests or actions against the war.

Activists and dissidents both in Russia and abroad expose themselves to retaliation from Putin’s regime—a fact that they are acutely aware of. “I'm a reasonable person, I don’t think I'm invulnerable or immortal,” Ponomarev says. “So I do understand that there are issues with security and everything. But I have done a lot of effort to protect myself and the place where I live, as well as the way I move across the city.” Those concerns have been heightened following Dugina’s assassination and Ponomarev’s subsequent declarations. On August 21, a member of the Russian government proposed a contest for the best video or photo of the dissident politician “crawling on broken legs and apologizing while spitting his teeth.”

“I’m not going to pretend that I am not scared at all,” says February Morning’s Lesnoy after his last interview of the day had ended. “But I live in Ukraine, where Putin is waging war. Everybody here is at risk.”

When asked about their motivation for joining the resistance and potentially exposing themselves to repression, an anonymous contributor to Rospartizan summed it up simply: “Let us use the platitude, ‘who else if not us?’”

The Telegram-Powered News Outlet Waging Guerrilla War on Russia

Plus: An Iranian hacking tool steals inboxes, LastPass gets hacked, and a deepfake scammer targets the crypto world.

This week, former Twitter chief security officer Peiter “Mudge” Zatko filed an explosive whistleblower complaint against the company. The allegations, which Twitter contests, claim the social media firm has multiple security flaws that it hasn’t taken seriously. Zatko alleges Twitter put an Indian government agent on its payroll and failed to patch servers and company laptops. Among the claims, however, one stands out: the suggestion that Twitter engineers could access live software and had virtually untracked access to its system.

In a privacy win for students across the US, an Ohio judge has ruled that it is unconstitutional to scan students’ homes while they are taking remote tests. We also detailed the privacy flaw that is threatening US democracy—a lack of federal privacy protections means mass surveillance systems could be used against citizens in new ways.

Elsewhere, as Russia’s full-scale invasion of Ukraine passes six months, military forces are increasingly turning to open source data to back their efforts. Police in India are using facial recognition with very low accuracy rates—the technology is being widely used in Delhi but could be throwing up plenty of false positives. And we dived deeply (perhaps too deeply) into how four high school students hacked 500 of their schools’ cameras, across six locations, and rickrolled thousands of students and teachers. It’s one elaborate graduation prank.

And there’s more. Each week, we highlight the news we didn’t cover in-depth ourselves. Click on the headlines below to read the full stories. And stay safe out there.

Since Russia-backed trolls flooded Facebook and Twitter with disinformation around the 2016 US elections, the social media firms have improved their ability to bust disinformation networks. The companies frequently take down propaganda accounts linked to authoritarian states, such as Iran, Russia, and China. But it’s rare that Western disinformation efforts are discovered and exposed. This week, the Stanford Internet Observatory and social media analysis firm Graphika detailed a five-year operation that was pushing pro-Western narratives. (The research follows Twitter, Facebook, and Instagram as they remove a series of accounts from their platforms for “coordinated inauthentic behavior.”)

The propaganda accounts used memes, fake news websites, online petitions, and various hashtags in an attempt to push pro-Western views and were linked to both overt and covert influence operations. The accounts, some of which appear to use AI-generated profile pictures, targeted internet users in Russia, China, and Iran, among other countries. The researchers say the accounts “heavily criticized” Russia following its full-scale invasion of Ukraine in February and also “promoted anti-extremism messaging.” Twitter said the activity it saw is likely to have originated in the US and the UK, while Meta said it was the US.

Many of the techniques used by the online influence operation appear to mimic those the Russia-backed accounts used in the buildup to the 2016 elections. It’s likely, however, that the Western influence operations weren’t that successful. “The vast majority of posts and tweets we reviewed received no more than a handful of likes or retweets, and only 19 percent of the covert assets we identified had more than 1,000 followers,” the researchers say.

In recent years, Charming Kitten, a hacking group linked to Iran, has been known for its “aggressive, targeted phishing campaigns.” These phishing efforts aim to gather the usernames and passwords of people’s online accounts. This week, Google’s Threat Analysis Group (TAG) detailed a new hacking tool Charming Kitten is using that’s capable of downloading people’s entire email inboxes. Dubbed Hyperscrape, the tool can steal people’s details from Gmail, Yahoo, and Microsoft Outlook. “The attacker runs Hyperscrape on their own machine to download victims’ inboxes using previously acquired credentials,” TAG says in a blog post. The tool can also open new emails, download their contents, and then mark them as unread, so as not to raise suspicions. So far, Google says it has seen the tool used against fewer than two dozen accounts belonging to people based in Iran.

Password management company LastPass says it has been hacked. “Two weeks ago, we detected some unusual activity within portions of the LastPass development environment,” the company wrote in a statement this week. LastPass says an “unauthorized party” was able to gain access to its development environment through a compromised developer account. While the hacker (or hackers) were within LastPass’s systems, they took some of its source code and “proprietary LastPass technical information,” the company says in its statement. It has not detailed which elements of its source code were taken, making it difficult to assess the seriousness of the breach. However, the company does say that customer passwords and data have not been accessed—there’s nothing LastPass users need to do in response to the hack. Despite this, the indictment is still likely to be a headache for the LastPass technical teams. (It’s not the first time LastPass has been targeted by hackers either.)

The chief communications officer of crypto exchange Binance claims scammers created a deepfake version of him and tricked people into attending business meetings on Zoom calls with his fake. In a blog post on the company’s website, Binance’s Patrick Hillmann said that several people had messaged him for his time. “It turns out that a sophisticated hacking team used previous news interviews and TV appearances over the years to create a ‘deepfake’ of me,” Hillmann wrote, adding that the alleged deepfake was “refined enough to fool several highly intelligent crypto community members.” Neither Hillmann nor Binance has posted any images showing the claimed deepfake. Since deepfakes first emerged in 2017, there have been relatively few incidents of faked video or audio scams impersonating people. (The vast majority of deepfakes have been used to create nonconsensual pornographic images). However, recent reports say deepfake scams are on the rise, and in March of last year the FBI warned that it anticipated a rise in malicious deepfakes within the next 12 to 18 months.

A US Propaganda Operation Hit Russia and China With Memes

The phishing attack on the SMS giant exposes the dangers of B2B companies to the entire tech ecosystem.

The communication company Twilio suffered a breach at the beginning of August that it says impacted 163 of its customer organizations. Out of Twilio's 270,000 clients, 0.06 percent might seem trivial, but the company's particular role in the digital ecosystem means that that fractional slice of victims had an outsized value and influence. The secure messaging app Signal, two-factor authentication app Authy, and authentication firm Okta are all Twilio customers that were secondary victims of the breach.

Twilio provides application programming interfaces through which companies can automate call and texting services. This could mean a system a barber uses to remind customers about haircuts and have them text back “Confirm” or “Cancel.” But it can also be the platform through which organizations manage their two-factor authentication text messaging systems for sending one-time authentication codes. Though it's long been known that SMS is an insecure way to receive these codes, it's definitely better than nothing, and organizations haven't been able to move away from the practice completely. Even a company like Authy, whose core product is an authentication code-generating app, uses some of Twilio's services.

The Twilio hacking campaign, by an actor that has been called “0ktapus” and “Scatter Swine,” is significant because it illustrates that phishing attacks can not only provide attackers valuable access into a target network, but they can even kick off supply chain attacks in which access to one company's systems provides a window into those of their clients.

“I think this will go down as one of the more sophisticated long-form hacks in history,” said one security engineer who asked not to be named because their employer has contracts with Twilio. “It was a patient hack that was super-targeted yet broad. Pwn the multi-factor authentication, pwn the world.”

Attackers compromised Twilio as part of a massive, yet tailored phishing campaign against more than 130 organizations in which attackers sent phishing SMS text messages to employees at the target companies. The texts often claimed to come from a company's IT department or logistics team and urged recipients to click a link and update their password or log in to review a scheduling change. Twilio says that the malicious URLs contained words like "Twilio," "Okta," or "SSO" to make the URL and the malicious landing page it linked to seem more legitimate. Attackers also targeted the internet infrastructure company Cloudflare in their campaign, but the company said at the beginning of August that it wasn't compromised because of its limits on employee access and use of physical authentication keys for logins. 

“The biggest point here is the fact that SMS was used as the initial attack vector in this campaign instead of email,” says Crane Hassold, director of threat intelligence at Abnormal Security and a former digital behavior analyst for the FBI. “We’ve started to see more actors pivoting away from email as initial targeting and as text message alerts become more common within organizations it’s going to make these types of phishing messages more successful. Anecdotally, I get text messages from different companies I do business with all the time now, and that wasn’t the case a year ago.”

The hackers used their Twilio access to compromise 93 Authy accounts and authorize additional devices that the attacker controlled instead of the account owner. Authy has roughly 75 million users in all. Meanwhile, the Twilio breach potentially exposed 1,900 accounts on the encrypted communication app Signal, and attackers seem to have actually used the access to initiate takeovers of as many as three accounts. Because of how Signal is designed, attackers wouldn't have gotten access to a user's message history or contact list but would have been able to impersonate the user and send messages while in control of the account.

On Thursday, the online food delivery service DoorDash announced that it suffered a breach of some internal systems and user data because one of its third-party service providers was compromised. “Based on our investigation, we determined the vendor was compromised by a sophisticated phishing attack,” DoorDash wrote in a statement. “The unauthorized party used the stolen credentials of vendor employees to gain access to some of our internal tools.” The marketing automation platform Mailchimp said earlier this month that it was breached in a phishing attack on its employees as well.

Researchers from the cybersecurity firm Group-IB said in a report on Thursday that it had identified and notified 136 organizations that seemed to be victims of the phishing campaign. Of those, 114 victim companies are based in the United States. And the researchers found that the majority of targets are cloud services, software development companies, or IT management firms. The findings underscore the seemingly thoughtful and targeted nature of the campaign to maximize impact by focusing on internet infrastructure and business management services that provide crucial support, including components of login authentication, for large clients.

“We are very disappointed and frustrated about this incident,” Twilio wrote in an update on August 10. “Trust is paramount at Twilio, and we recognize that the security of our systems and network is an important part of earning and keeping our customers' trust.”

Phishing has been an inveterate and consequential threat for years, playing a role in many impactful breaches around the world, including Russia's attack on the Democratic National Committee in 2016. But if the next phase of the trend is phishing-fueled supply chain attacks, the scale of the collateral damage will magnify in an unprecedented way.

Why the Twilio Breach Cuts So Deep

An attack on Russian mercenaries shows how militaries are increasingly using open source data—with sometimes deadly consequences.

The shadowy Russian Wagner paramilitary group has been responsible for atrocities around the world. After first surfacing during Russia’s 2014 annexation of Crimea, Wagner mercenaries have been spotted across Central Africa, Syria, and Libya. Since March, according to British intelligence, Wagner forces have been operating in Ukraine, directly alongside Russia’s official military forces.

One part of the Wagner group was attacked in the city of Popasna, Ukraine, earlier this month. On August 8, a pro-Russian journalist in the area shared photos on the Telegram messaging app that allegedly showed the local Wagner headquarters. In doing so, they exposed the location of the group. One photo, which has since been deleted, included a sign revealing the base’s address. Ukrainian forces put the data to work.

A few days after the photos were posted online, Ukraine’s military turned the base to rubble, claiming they hit it using American-made rocket systems. A Ukrainian government official said that it “seems” the Wagner-operated location was found using the photos shared on Telegram. The strike appears to be one of the latest incidents in Russia’s full-scale invasion of Ukraine where open source intelligence—knowledge gained from publicly available information—has been used to target military attacks or inform tactical operations.

Analysts and online sleuths, such as journalists at the investigative news outlet Bellingcat, have developed and professionalized open source investigation techniques for years. Open source intelligence, also known as OSINT, involves the use of public data—such as social media posts, flight tracking data, and satellite images, among other sources—to let anyone investigate events worldwide, from potential war crimes to human rights violations.

Piecing together small details from multiple sources of information can allow investigators to understand a clearer picture of events on the ground. For instance, comparing features in a photograph, such as a row of trees, and matching them to satellite images can reveal a real-world location. OSINT investigations have previously uncovered Russia’s involvement in the downing of flight MH17; tracked down soldiers in Cameroon who allegedly killed children; and tackled human rights violations around the world.

Many of these investigations often take place online, far from events and often months or years after the events that have taken place. Throughout Russia’s invasion of Ukraine, OSINT has played a big role and changed many of the rules of conventional war. Satellite images have shown Russian troop buildups around Ukraine’s borders, identified Russian army commanders, and tracked those alleged to have killed Ukrainian prisoners of war.

“What you’re now seeing in Russia and Ukraine is a lot more of open source investigations geolocating targets, bases, military equipment,” says Jack McDonald, a senior lecturer in war studies at King’s College London, who studies information and privacy in war. OSINT has the potential to provide crucial intelligence to military forces defending Ukraine and launching counterattacks. McDonald says one of the biggest changes during this conflict has been the Ukraine government’s repurposing of the Diia public services app, which includes an “e-Enemy” feature allowing people to report the movements of Russian troops.

When it comes to militaries launching attacks using open source intelligence (including in the Wagner incident), it is unlikely that they will do so solely based on data gleaned from social media. While Ukrainian officials have said the photos of the Wagner base were useful, it is not clear whether they combined this with existing information before they launched their attack. Ukraine’s Ministry of Defence did not respond to questions about how it is using open source intelligence. However, it did recently share a photo online claiming that a Russian tourist posed for holiday photos in front of Russian air defense systems.

“Militaries like to have fidelity if they’re going to do a kinetic strike or target something—they have to justify their targeting,” says Maggie Smith, an assistant professor at the Army Cyber Institute at West Point, adding that her views do not represent those of the US military. Smith says OSINT can “show you where activity may be so that you can point more exquisite intelligence assets to focus on that area and get better visibility, better granularity, learn more about it.”

The Wagner attack is not the only instance of military action based (at least in part) on information published online. In June, the Centre for Information Resilience (CIR), a nonprofit organization that counters influence operations, published a report saying a pro-Russian OSINT group used footage from a Ukrainian news channel to locate a munitions factory in Kyiv. The building was then hit by Russian missiles, and three civilians were killed. People in Ukraine have also faced criticism for sharing social media footage of their locations.

Anything that is posted online can be used by military forces for their planning or operations. “As a commander on the ground, you have to be aware that so much data is being produced about every single one of your soldiers at any given time,” Smith says. “The signals that are emitted from cell phones or any of anybody’s web presence, anything like that, can send signals to your adversary about your location, potential training cycles, all those types of things. Any sort of photo that is posted by anybody in your ranks can probably be used to help identify where you’re located, what assets you may have.” (In the past, public data from fitness app Strava exposed military bases, as well as the names and heart rates of soldiers on them.)

Giangiuseppe Pili, an open source intelligence research fellow at the Royal United Services Institute for Defence and Security Studies, says that OSINT has been used by militaries and intelligence for years, but there has recently been an acceleration in what is possible. “The big change is the data fusion capability of open source intelligence now—so to combine different sources into one product that really brings a picture of the reality in a realistic sense,” Pili says. The speed of analyzing open source data has also increased, Pili says.

In addition to ensuring that data is accurate before it is acted on, McDonald says that there may be privacy questions of militaries using open source data that they scrape from social media. “We don’t really have a good understanding of what the limits should be or whether there should be any limits,” McDonald says, adding that if citizens send in information they have taken, this could make them military targets, further blurring the line between civilian and combatant.

While OSINT is being used on the ground for military purposes, it’s also being used in Ukraine to clean up after battles have taken place. Andro Mathewson, a research officer at the HALO Trust, is using open source data in Ukraine to help clear landmines and understand what weapons are being used. This largely comes from social media posts. “Our analysis helps us to plan our operations, tailor our demining training, and know what to educate people about in our risk education outreach,” Mathewson says.

In April, HALO Trust relocated its headquarters to the Kyiv region to focus on “clearing the contamination from the occupation” in the area, Mathewson says. “During our open source data trawling, I spotted a cluster of tractor and combine harvester accidents caused by antitank mines in Makarov,” they say. “Things like videos of burning tractors or photographs of large craters, or destroyed vehicles missing wheels.” As a result of the social posts and the open source data, the group was able to deploy its teams to the area and start clearing the destruction.

Their Photos Were Posted Online. Then They Were Bombed

An Ohio judge ruled that such surveillance to prevent cheating could form a slippery slope to more illegal searches.

As the pandemic unfolded in spring 2020, an Educause survey found that an increasing number of students—who had very little choice but to take tests remotely—were increasingly putting up with potential privacy invasions from schools. Two years later, for example, it’s considered a common practice that some schools record students throughout remote tests to prevent cheating, while others conduct room scans when the test begins.

Now—in an apparent win for students everywhere—an Ohio judge has ruled that the latter practice of scanning rooms is not only an invasion of privacy but a violation of the Fourth Amendment’s guaranteed protection against unlawful searches in American homes.

The decision came after a Cleveland State University student, Aaron Ogletree, agreed to a room scan before a chemistry exam, even though his teacher had changed their policy, and he did not expect it to happen before the test. Because there were others in his home, he took the test in his bedroom, where he says he had sensitive tax documents spread out on a surface. These confidential documents, he claimed, could not be moved before the test and were visible in the room scan recording—which was shared with other students.

After the test, Ogletree sued Cleveland State for violating his Fourth Amendment rights, and Ohio judge J. Philip Calabrese decided on August 22 that Ogletree was right: Room scans are unconstitutional.

Before the decision, Cleveland State defended its room scanning practice by saying that it had become common during the pandemic and, therefore, more acceptable to society.

Under the Fourth Amendment, only reasonable searches are protected, and the university did not see their room scans as unreasonable. Part of the school’s logic was that Ogletree knew there would be a room scan and was not coerced into scanning his room. They say he also could’ve prepared to remove any sensitive documents from the room or simply chosen to take the test in a different room. The university claimed that the room scans were considered so universally harmless by students that nobody ever complained about the practice before Ogletree.

Calabrese did not accept this defense, partly because “rooms scans go where people otherwise would not”—like Ogletree’s bedroom—and partly because the home has always been considered a core protected space where privacy could be reasonably assumed in the US.

“Though schools may routinely employ remote technology to peer into houses without objection from some, most, or nearly all students, it does not follow that others might not object to the virtual intrusion into their homes or that the routine use of a practice such as room scans does not violate a privacy interest that society recognizes as reasonable, both factually and legally,” Calabrese wrote.

A Cleveland State spokesperson provided Ars with this statement: “As directed by the Court, Cleveland State University’s counsel will confer with Mr. Ogletree’s counsel on appropriate next steps. Ensuring academic integrity is essential to our mission and will guide us as we move forward. While this matter remains in active litigation, we are unable to comment further.”

Remote Scans Slippery Slope to More Illegal Searches?

Calabrese’s decision came down to what the law considered reasonable for schools attempting to prevent cheating.

Ultimately, because Cleveland State unevenly used room scans—they are optional by the teachers’ discretion—and the school had various other methods to combat cheating, the judge said the room scans could not be considered a justified privacy invasion. He also said that because the pandemic, and Ogletree’s family’s health concerns, prevented the student from accessing other options like in-person testing, any student “who valued privacy” would have to sacrifice the right to privacy at home to remain enrolled. That benefit—unlike the loss of benefits from social support programs without agreeing to a home search by the state—does not outweigh the loss of privacy to citizens, Calabrese wrote.

Scans of Students’ Homes During Tests Are Deemed Unconstitutional

Without robust federal protections, the country's widespread mass surveillance systems could be used against citizens like never before.

Talk of creeping authoritarianism in the United States seems to be everywhere—in the news, in books, and in conversations among neighbors around the country. The January 6 insurrection and the events that followed have Americans increasingly worried about the fate of democracy in their country.

An NPR/Ipsos poll from January found that 64 percent of Americans believe democracy is “in crisis and at risk of failing.” A Yahoo News/YouGov poll from June found that more than half of Democrats and Republicans think it’s “likely” the US will “cease to be a democracy in the future.”

The two most likely Republican presidential nominees for 2024—Donald Trump and Ron DeSantis—both exhibit an authoritarian mindset. Critics are ringing alarm bells over what could happen to American democracy should one of these men end up in the White House, but little has been said about what the current president and Congress could do right now to constrain a future autocrat.

One of the primary tools authoritarian leaders around the world use to control their citizens is mass surveillance. Neil Richards, a law professor at Washington University in St. Louis, says Congress needs to pass legislation that protects the privacy of Americans so existing surveillance mechanisms can no longer be abused.

“We need a robust federal privacy law, we need robust enforcement mechanisms, we need to somehow rein in the commercial surveillance apparatus because that’s a key component in authoritarian regimes. … They co-opt the existing cameras and sensors,” Richards says. “It used to be that it would be a fascist’s dream to have a camera and a speaker in every home, and of course, we did it to ourselves.”

Woodrow Hartzog, a law professor at Boston University, says any privacy laws that Congress passes need to be written with the understanding that a future president could try to find ways to get around these privacy protections.

“Congress should focus on making sure that the rules that they do pass are specific and constrained enough to give a legal mandate and prevent shenanigans when a different regime takes over,” Hartzog says. “If you create a rule that can easily be watered down or circumvented, then that’s not a very helpful privacy rule.”

Congress is working on data privacy legislation known as the American Data Privacy Protection Act, but critics have claimed that it doesn’t go far enough to protect people’s privacy. The Federal Trade Commission is also reportedly working to create new rules for how large tech companies handle people’s data, and Hartzog says those rules could theoretically provide a helpful check on an authoritarian government because it would have less ability to “co-opt our own devices against us.”

As many Americans learned following the overturning of _Roe v Wade_, it’s important to have strong privacy rights in place before changes in the law or shifts in power threaten basic civil liberties. What doesn’t appear to be a major risk to your rights now can become a substantial threat later on.

“Everybody should care about privacy because information is power, and human information confers power over human beings,” Richards says. “In an information society where so many decisions are made based upon our data, having meaningful protections for that information across the board is essential if we are to remain free, happy, and able to flourish in our lives.”

Richards notes that following President Richard Nixon’s resignation in the 1970s, American lawmakers realized they needed to protect against future presidents abusing their power in the ways Nixon did, which led to major policy reforms. He says something similar should happen now.

“This has happened before. After Watergate, where it was clear that President Nixon had abused the powers of his office and had violated the privacy of American citizens, there were a series of rules put in place restricting the ability of future presidents to do that,” Richards says. “There was a federal privacy law—the Privacy Act of 1974 was passed—there were a whole bunch of open government and government ethics rules that were put in place.”

Following the resignation of Richard Nixon over the Watergate scandal, Congress passed legislation like the Ethics in Government Act, the Government in the Sunshine Act, the Inspector General Act of 1978, the Presidential Records Act, and more in response to the Nixon administration’s widespread misconduct. Former President Trump is now facing the possibility of being charged with violating the Presidential Records Act over his handling of classified documents.

Congress needs to pass new legislation to protect privacy and protect against corruption, Richards says, because we’ve seen what can happen when a president decides to test how much they’re able to do with the power that’s available to them. He says the Trump administration demonstrated this repeatedly.

There is the risk of any legislation Congress passes being struck down by what is now an ultra-conservative Supreme Court, however. Hartzog says legislation will have to be written with this in mind.

“Anything that is going to get passed has to be cognizant of the state of the Supreme Court right now and their tendencies,” Hartzog says. “That includes, of course, a very skeptical view of certain kinds of privacy, such as decisional privacy rights, as we’ve seen with _Roe_ recently.”

A law that based a right to privacy on long-standing traditions may not be struck down by the current Supreme Court—with its so-called originalist point of view—and Hartzog says lawmakers are already starting to focus on this strategy when crafting legislation.

It’s also going to be important to build up and safeguard institutions, Richards says, because strong institutions help prevent would-be authoritarians from wielding so much power. He says government agencies should be doing everything they can to become more independent and more robust so they can withstand future abuses of power, and Congress should work to protect these institutions.

Congress has spent ample time focusing on how to keep the next presidential election from being stolen, but it hasn’t really considered what it could be doing to protect the rights of Americans if an election ends up being stolen or a would-be authoritarian wins an election outright.

If support for authoritarian leaders remains strong, one could feasibly come to power. Preparing for that now is better than simply reacting to abuses of power when they inevitably use the weapons we left waiting for them.

The Privacy Flaw Threatening US Democracy

Peiter “Mudge” Zatko’s claims about the company’s lax security are all bad. But one clearly captures the extent of systemic issues.

On Tuesday, both CNN and _The Washington Post_ reported on accusations from former Twitter chief security officer Peiter Zatko, often known as “Mudge,” that the company’s security practices are dangerously lacking. It’s a litany of charges that range from misleading bot counts to the employment of a known foreign government agent. But one allegation stands out among the rest.

Engineers across Twitter, according to Zatko’s disclosure, had extensive access to the social network's live, deployed software platform. Not only that, there was also minimal monitoring and logging to track who did what in this production environment. That would leave an opening for someone with unintended access or malign intentions to view user data or even make changes to the platform without raising alarms or leaving a clear trail. While all of Zatko’s claims are serious, none more clearly captures the allegation of fundamental, systemic issues within the company.

Last month, Zatko and his attorneys sent hundreds of pages of documents to the US Department of Justice, Securities and Exchange Commission, and Federal Trade Commission detailing the myriad allegations of security and privacy failures at Twitter. The claims have potentially significant implications in the dispute about whether Elon Musk must go through with his agreement to purchase the company for $44 billion. If true, they also have immediate ramifications for Twitter's hundreds of millions of users.

“Twitter is grossly negligent in several areas of information security,” Zatko wrote in a final report to the company after being fired in January. He added in his government disclosure, “It was impossible to protect the production environment. All engineers had access. There was no logging of who went into the environment or what they did.”

“Mr. Zatko was fired from his senior executive role at Twitter in January 2022 for ineffective leadership and poor performance,” Twitter said in a statement provided to WIRED by spokesperson Lindsay McCallum-Rémy. “What we’ve seen so far is a false narrative about Twitter and our privacy and data security practices that is riddled with inconsistencies and inaccuracies and lacks important context. Mr. Zatko's allegations and opportunistic timing appear designed to capture attention and inflict harm on Twitter, its customers, and its shareholders. Security and privacy have long been company-wide priorities at Twitter and will continue to be.”

Twitter first hired Zatko in November 2020, months after a sweeping attack resulted in the compromise of multiple high-profile accounts, including those of Apple, Kanye West, Jeff Bezos, and Elon Musk. Previously, he’d built a strong reputation over decades as part of the hacker collective L0pht and a cybersecurity expert for organizations including the Defense Advanced Research Projects Agency, Google, and Stripe.

The documents Zatko submitted describe a situation in which almost a third of employee laptops did not receive automatic software updates, and half of Twitter's data center servers had not been adequately updated and didn't support data encryption at rest. Zatko also alleges that there was no management protocol for staffers' smartphones, meaning that the company had no oversight for thousands of employee devices that connected to “core” systems. But his allegations about security issues in Twitter's “fundamental architecture” reflect the core of the problems.

Zakto further alleges that Twitter has no comprehensive development or testing environments for piloting new features and system upgrades before launching them in the live production software. As a result, Zatko describes a situation where engineers would work alongside live systems and “test directly on the commercial service, leading to regular service disruptions.” And the documents allege that half of Twitter's employees had privileged access to live production systems and user data without monitoring to be able to catch any rogue actions or trace unwanted activity. Zatko’s complaint describes Twitter as having roughly 11,000 staffers. Twitter says it has about 7,000 employees currently.

The complaints assert that these poor security practices explain Twitter's track record of security incidents, data breaches, and dangerous user account takeovers.

“We are reviewing the redacted claims that have been published," Twitter CEO Parag Agrawal wrote in a message to Twitter staff this morning. “We will pursue all paths to defend our integrity as a company and set the record straight.”

Twitter says that all employee computers are centrally managed and that its IT department can force updates or impose access restrictions if updates aren't installed. The company also said that before a computer can connect to production systems, it must pass a check to ensure its software is up-to-date, and that only employees with a “business justification” can access the production environment for “specific purposes.”

Al Sutton, cofounder and chief technology officer of Snapp Automotive, was a Twitter staff software engineer from August 2020 to February 2021. He noted in a tweet on Tuesday that Twitter never removed him from the employee GitHub group that can submit software changes to code the company manages on the development platform. Sutton had access to private repositories for 18 months after being let go from the company, and he posted evidence that Twitter uses GitHub not only for public, open source work, but for internal projects as well. Within about three hours of posting about the access, Sutton reported that it had been revoked.

“I think Twitter is being pretty casual about Mudge's claims, so I thought a verifiable example might be useful for folks,” he told WIRED. When asked whether Zatko’s accusations track with his own experience working at Twitter, Sutton added, “I think the best thing to say here is that I have no reason to doubt his claims.”

Security engineers and researchers emphasize that while there are different ways to approach production environment security, there is a conceptual problem if employees have broad access to user data and deployed code without extensive logging. Some organizations take the approach of drastically limiting access, while others use a combination of broader access and constant monitoring, but either option must be a conscious choice that a company invests heavily in. After the Chinese government breached Google in 2010, for example, the company went all in on the former approach. 

“It’s not actually that unusual for companies to have relatively liberal policies about giving engineers access to production systems, but when they do they are very, very strict about logging everything that gets done,” says Perry Metzger, managing partner of the consultancy Metzger, Dowdeswell & Company. “Mudge has a sterling reputation, but let’s say he was completely incompetent. The easy thing for them to do would be to provide technical details of the logging systems that they use for engineer access to production systems. But what Mudge is portraying is a culture where people would prefer to cover things up than to fix them, and that is the disturbing bit.”

Zatko and Whistleblower Aid, the nonprofit legal group representing him, say they stand by the documents released on Tuesday. “Twitter has an outsized influence on the lives of hundreds of millions around the world, and it has fundamental obligations to its users and the government to provide a safe and secure platform,” Libby Liu, CEO of Whistleblower Aid, said in a statement.

For now, though, the allegations raise a swath of serious concerns that seem unlikely to be quickly explained away or comprehensively resolved.

The Most Damning Allegation in the Twitter Whistleblower’s Report

As a graduation prank, four high school students hijacked 500 screens across six school buildings to troll their classmates and teachers.

At 10:55 am on April 30, 2021, all the TV screens and classroom projectors at six schools in Cook County, Illinois, started controlling themselves. Screens that were turned off powered up. Projectors that were already on automatically switched to the HDMI input. “Please standby for an important announcement,” read a message that flashed up on the displays. A five-minute timer, counting down to zero, sat under the ominous message.

A teacher in one classroom tried to turn the projector off using the infrared remote, but it was useless. “They overtook our projector,” the teacher, caught on video, told students. The group speculated that it could be a message from President Joe Biden, failing that, “big brother.” The same scene was repeating itself across dozens of classrooms in Illinois’ school district 214—home to 12,000 students. In classrooms and hallways, more than 500 screens displayed the countdown. The system had been hijacked.

Tucked in the corner of one classroom was Minh Duong, a senior on the verge of graduating. Duong sat pouring over his laptop, chatting with three other friends—Shapes, Jimmy, and Green—on encrypted messenger Element, making sure the last of his custom code executed correctly. As the countdown hit zero, a grainy, gyrating Rick Astley burst into the first notes of “Never Gonna Give You Up.”

“I was walking down the hallway, and everyone was kind of laughing—it was kind of fun to watch,” Duong, who also goes by the moniker WhiteHoodHacker, tells WIRED. Later that day, at 2:05 pm, Duong and his friends took over the schools’ PA systems and played the song one last time.

The elaborate high school graduation prank—dubbed The Big Rick by its architects—was one of the largest rickrolls to ever take place, taking months of planning to pull off. “I was actually extremely hesitant about doing the entire district,” Duong says.

During the process, the group broke into the school’s IT systems; repurposed software used to monitor students’ computers; discovered a new vulnerability (and reported it); wrote their own scripts; secretly tested their system at night; and managed to avoid detection in the school’s network. Many of the techniques were not sophisticated, but they were pretty much all illegal.

Minh Duong started hacking his school during his freshman year when he was about 14. “I didn't understand basic ethics or responsible disclosure and jumped at every opportunity to break something,” he writes in a blog post describing the rickroll. (Duong recently presented the Big Rick at the Def Con hacker conference, where he revealed new details about the incident.) During his freshman year, using a computer in a cupboard next to the IT classroom, he started scanning the school’s internal network, looking for connected devices and ultimately laying the groundwork for the rickroll years later.

Duong, now 19, says he was able to access internet-connected security cameras throughout the school, posting a picture of himself in his eventual blog post. (He says the issue was reported and access was shut down—and he was caught and told to stop scanning the school’s network.)

The Big Rick involved three key components, two of which were originally accessed in Duong’s early high school years. First, he acquired a teacher’s version of LanSchool, a “classroom management” software that can track everything students do, including monitor students’ screens and log keystrokes. They used the software to run scans and exploit the systems while making them appear as if they were in one of the district’s other schools.

Next, he had access to the school’s IPTV system, which controls hundreds of projectors and TVs across the district. When the pandemic struck, Duong says, he mostly forgot about the access to the systems, which he had scanned years earlier, and the school didn’t go back to in-person learning until the end of his senior year. That’s when he decided to do the rickroll, which he says he picked because teachers would likely get the joke.

Duong and his three friends managed to get some access to the projectors and TVs using default usernames and passwords, which hadn’t been changed. The system has receivers that directly connect to projectors and displays, encoders that broadcast video, and servers that allow products to be managed centrally by administrators.

However, Duong decided sending out the rickroll using the servers would be too risky. “Every time you make a request, it’s going to send a lot of requests to all the projectors,” Duong explains. “That’s going to generate a lot of traffic. That’s going to make things very detectable.”

Instead, he created a script to act as a payload, which could be uploaded to each receiver ahead of the rickroll. During the month before the Big Rick, the group sent the script to each of the media players in several batches, reducing the chances of school admins detecting them. He tested the streaming setup at night, so as not to disrupt classes. Duong says he would remotely connect to one PC in the school’s computer lab, which he remotely accessed through the computer club. “I would record a video to test if the projector displayed the stream correctly,” he says, posting a video of the setup.

The group also built out the system—running it on a loop—to avoid teachers turning it off on the day of the rickroll. “Every 10 seconds, the display would power on and set the maximum volume,” Duong wrote in the blog post. The only real way for teachers to disable the stream would be to change the input source from HDMI on the projectors or pull the power cable. “Then we disable infrared remotes,” he says, in case teachers tried to use them to stop the videostream. There was also a failsafe: A few seconds before Astley was unleashed, the projectors were reset to play the correct feed.

Three days before the rickroll, with most of the setup prepared, the group had a breakthrough. While scanning the district network (again) they found EPIC, the Education Paging and Intercom Communications system—the prank’s third component. This controls the hallway and classroom speakers and is used for teacher announcements, fire alarms, and end-of-lesson bells. It can also play custom audio tracks.

Like the IPTV system, the group tried to access EPIC using default usernames and passwords. “It's not really like a sophisticated attack,” Duong says. “The whole thing is script kiddies using default passwords and doing random stuff there.” But the defaults didn’t work.

“I GOT THE PASSWORD TO THE PPA SYSTEM,” Shapes messaged the group on April 29. Yes, the default had been changed—to a password example given in the user manual, which was available online. From here, the team discovered another admin account—the password was password—that could allow them to access the entire district’s speakers.

The night before the Big Rick, the speaker system was set to automatically trigger in the afternoon.

While the Big Rick was always intended as a high school prank—Duong says other pranks last year included students toilet-papering some trees—the hacking was very likely to be outside the law. The students accessed networks they weren’t supposed to—a lawyer might call it “unauthorized access” under the Computer Fraud and Abuse Act. And a malicious hacker could have stolen data, moved through the systems, or used the access to try to cause harm. “I totally was expecting they would get the police in,” Duong says, adding things were “pretty scary” for a bit.

Knowing the risk, the four students involved were keen to show they hadn’t accessed the school’s equipment for anything more than a prank. When the rickroll ended, their script reset the systems to their original state. The only thing they couldn’t do, Duong says, was to make sure that projectors that had been off turned back off. All told, it was a success.

“Definitely the teachers found it very funny,” Duong says. One tweeted: “😂😂😂 Very clever, seniors!” Duong says the only complaint he heard was that Astley was too loud. “Which is fair, because I set the volume to max.” But it wasn’t only the teachers’ response that had the group worried.

“The thing that really prevented us from being in trouble is the report that we sent,” Duong says. Ahead of the rickroll, the team wrote up a 26-page report, which was sent to the admins straight after the incident, that detailed what they had done and provided security suggestions.

The report—Duong shared a redacted version with WIRED—says the group had a set of guidelines. It says they would not do anything that could harm the safety of others; would look to keep any disruption to learning at a minimum (they picked a Friday near the end of term, right at the end of a period); would not access sensitive private information; would not leave systems weaker than they found them; and all the decisions would be made together as a group. Their report also explained what school administrators could do to stop this from happening again—for instance, changing all default passwords.

A couple of weeks later, the school replied. “Because of your strict guidelines and openness to share the information, we will not be pursuing discipline,” an email from the district’s director of technology says. Duong shared the email as part of his talk at Def Con.

A spokesperson for the D214 school district tells WIRED they can confirm the events in Duong’s blog post happened. They say the district does not condone hacking and the “incident highlights the importance of the extensive cybersecurity learning opportunities the District offers to students.”

“The District views this incident as a penetration test, and the students involved presented the data in a professional manner,” the spokesperson says, adding that its tech team has made changes to avoid anything similar happening again in the future.

The school also invited the students to a debrief, asking them to explain what they had done. “We were kind of scared at the idea of doing the debrief because we have to join a Zoom call, potentially with personally identifiable information,” Duong says. Eventually, he decided to use his real name, while other members created anonymous accounts. During the call, Duong says, they talked through the hack and he provided more details on ways the school could secure its system.

Duong, who is now studying computer science at the University of Illinois at Urbana-Champaign, insists the rickroll was just a high school prank, not a wider message on the state of his school’s security. (In recent months, cybersecurity agencies have warned against schools being hit, and some have suffered from ransomware attacks.)

“It was meant to be something that’s fun, and not super serious, or have some sort of message about the state of our school’s security,” he says. In several places during his blog post and Def Con talk, Duong reiterates he could have faced trouble. “I definitely cannot tell anyone to do something like this,” he says. “Because it really is illegal. I was just a lucky case.”

Source

Wired